Kahdah, here is both the Hijac This and the combofix scans!
ComboFix 08-04-12.5 - Compaq_Administrator 2008-04-13 1:16:46.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.92 [GMT -7:00]Running from: C:\Documents and Settings\Compaq_Administrator\Desktop\Combofix45.exe
* Created a new restore point
.
TimedOut: progfile.dat
((((((((((((((((((((((((( Files Created from 2008-03-13 to 2008-04-13 )))))))))))))))))))))))))))))))
.
2008-04-11 08:45 . 2008-04-12 06:47 <DIR> d-------- C:\Documents and Settings\Compaq_Administrator\DoctorWeb
2008-04-11 03:35 . 2008-04-12 21:55 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-11 03:35 . 2008-04-11 03:35 1,409 --a------ C:\WINDOWS\QTFont.for
2008-04-10 22:56 . 2008-03-01 06:06 6,066,176 --------- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-04-10 22:56 . 2007-06-30 20:31 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-04-10 22:56 . 2007-06-30 20:36 991,232 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-04-10 22:56 . 2008-03-01 06:06 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-04-10 22:56 . 2008-03-01 06:06 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-04-10 22:56 . 2008-03-01 06:06 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-04-10 22:56 . 2008-03-01 06:06 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll
2008-04-10 22:56 . 2008-03-01 06:06 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-04-10 22:56 . 2008-02-22 03:00 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-04-10 08:40 . 2008-04-10 08:40 <DIR> d-------- C:\Program Files\Bonjour
2008-04-10 08:31 . 2008-04-10 08:31 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-04-09 17:10 . 2006-06-01 11:47 163,840 --------- C:\WINDOWS\system32\dllcache\jgdw400.dll
2008-04-09 17:10 . 2006-06-01 11:47 27,648 --------- C:\WINDOWS\system32\dllcache\jgpl400.dll
2008-04-09 17:05 . 2006-05-05 02:41 453,120 --------- C:\WINDOWS\system32\dllcache\mrxsmb.sys
2008-04-09 09:45 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-04-09 09:43 . 2004-07-20 17:24 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll
2008-04-09 09:43 . 2004-07-20 17:24 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll
2008-04-09 09:43 . 2004-07-20 17:24 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll
2008-04-09 09:43 . 2004-07-09 09:43 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll
2008-04-09 09:43 . 2004-07-20 17:24 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll
2008-04-09 09:43 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2008-04-09 09:43 . 2001-06-26 08:15 38,912 --------- C:\WINDOWS\system32\picn20.dll
2008-04-09 09:43 . 2001-03-08 19:30 24,064 --------- C:\WINDOWS\system32\msxml3a.dll
2008-04-08 18:17 . 2006-03-03 21:03 282,680 --a------ C:\WINDOWS\system32\HPZidr12.dll
2008-04-08 18:17 . 2006-03-03 21:02 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2008-04-08 18:17 . 2006-03-03 21:02 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2008-04-08 18:17 . 2007-08-09 00:27 73,728 --a------ C:\WINDOWS\system32\HPZipm12.exe
2008-04-08 18:17 . 2006-03-03 21:03 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe
2008-04-08 18:17 . 2006-03-03 21:02 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2008-04-08 18:15 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-04-08 18:15 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-04-08 16:52 . 2008-04-09 09:37 896 --a------ C:\WINDOWS\system\Cmicnfg3.ini
2008-04-08 16:44 . 2004-08-03 23:08 10,624 --a------ C:\WINDOWS\system32\drivers\gameenum.sys
2008-04-08 16:44 . 2004-08-03 23:08 10,624 --a------ C:\WINDOWS\system32\dllcache\gameenum.sys
2008-04-08 16:35 . 2008-04-08 16:35 1,827 -rahs---- C:\WINDOWS\system32\drivers\103C_HP_CPC_RK513AA-ABA SR2032X NA680_YC_0Pres_QCNH635_E64NAemREA3_48_INAOS_SASUSTek Computer INC._V1.05_B3.00_T060630_WXP2_L409_M447_J200_7AMD_8Athlon 64_92.2_#061229_N_Z14F12F20_G10DE0241.MRK
2008-04-08 16:32 . 2006-08-14 16:08 <DIR> d-------- C:\Documents and Settings\Compaq_Administrator\WINDOWS
2008-04-08 16:32 . 2008-04-08 18:27 <DIR> d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\Netscape
2008-04-08 16:32 . 2006-08-14 16:09 <DIR> d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\Intuit
2008-04-08 16:31 . 2006-08-14 16:08 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\WINDOWS
2008-04-08 16:21 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-04-08 15:20 . 2008-04-12 03:07 <DIR> dr-hs---- C:\WINDOWS\system32\dllcache
2008-04-08 04:57 . 2008-04-08 04:57 0 --a------ C:\23990098.$$$
2008-04-07 20:45 . 2008-04-07 20:47 <DIR> d-------- C:\MY_Sweeny Todd
2008-04-07 08:02 . 2008-04-07 09:08 <DIR> d-------- C:\Downloads
2008-04-07 08:02 . 2008-04-07 09:11 <DIR> d-------- C:\Bases
2008-04-07 07:59 . 2008-04-08 08:22 <DIR> d-------- C:\Kaspersky
2008-04-06 21:41 . 2008-04-06 23:05 <DIR> d-------- C:\MY_Truman
2008-04-06 19:42 . 2008-04-06 21:14 <DIR> d-------- C:\MY_martian
2008-04-05 20:22 . 2008-04-05 20:31 <DIR> d-------- C:\ComboFix
2008-04-05 02:23 . 2008-04-05 02:24 <DIR> d-------- C:\WINDOWS\ERUNT
2008-04-05 01:45 . 2008-04-05 11:52 <DIR> d-------- C:\SDFix
2008-04-03 06:02 . 2008-04-03 06:18 <DIR> d-------- C:\Program Files\Panda Security
2008-04-02 21:59 . 2008-04-02 21:59 <DIR> d-------- C:\kav
2008-04-02 20:31 . 2008-04-02 20:31 <DIR> d-------- C:\_OTMoveIt
2008-04-02 10:47 . 2008-04-02 10:47 <DIR> d-------- C:\Deckard
2008-04-02 08:56 . 2008-04-02 08:56 0 --a------ C:\WINDOWS\iPlayer.INI
2008-04-01 23:36 . 2008-04-01 23:37 <DIR> d-------- C:\Program Files\InterActual
2008-04-01 19:37 . 2008-04-01 20:04 <DIR> d-------- C:\MY_DVD
2008-04-01 19:33 . 2008-04-01 19:33 5,744 --a------ C:\DVDVideo1_DVD.nrd
2008-04-01 19:32 . 2008-04-01 23:49 <DIR> d-------- C:\MY_DVDS
2008-03-29 01:03 . 2008-03-29 01:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-29 01:02 . 2008-03-29 01:02 <DIR> d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\SUPERAntiSpyware.com
2008-03-29 00:54 . 2008-03-29 00:54 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-03-28 23:37 . 2008-03-28 23:37 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-03-28 23:37 . 2008-03-28 23:37 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-03-28 09:45 . 2006-06-21 20:03 56 --a------ C:\ut9x.bat
2008-03-28 09:45 . 2006-06-19 14:08 54 --a------ C:\ut.bat
2008-03-28 09:32 . 2008-04-07 12:40 <DIR> d--h----- C:\Documents and Settings\All Users\Application Data\{36D03E21-363A-4CBC-9E13-A90BDCFAFB04}
2008-03-28 09:31 . 2008-03-28 09:31 <DIR> d-------- C:\Program Files\XPC Tools
2008-03-28 05:57 . 2008-03-28 05:59 <DIR> d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\MSNInstaller
2008-03-27 00:52 . 2008-03-27 04:39 2,262,417,408 --a------ C:\AWAKE.ISO
2008-03-27 00:20 . 2008-04-01 18:50 <DIR> d-------- C:\AWAKE
2008-03-25 18:54 . 2008-03-25 19:00 1,158 --ah----- C:\IPH.PH
2008-03-25 10:43 . 2008-04-12 23:28 <DIR> d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\AVG7
2008-03-25 10:42 . 2008-03-25 10:42 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-03-25 10:42 . 2008-04-08 19:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-03-25 05:26 . 2008-03-25 05:57 <DIR> d-------- C:\Program Files\Digital Locker Assistant
2008-03-25 04:35 . 2008-03-25 04:35 2,237,963 --a------ C:\Program Files\WinZip E-Mail Companion.zip
2008-03-24 08:09 . 2008-03-24 08:09 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-24 07:25 . 2008-03-24 07:56 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-03-24 07:25 . 2008-03-25 01:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-24 07:21 . 2008-03-24 07:51 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-03-24 06:37 . 2008-03-24 06:37 <DIR> d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\Grisoft
2008-03-24 06:37 . 2008-03-25 10:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-22 15:41 . 2008-03-22 15:41 25 --a------ C:\WINDOWS\mixerdef.ini
2008-03-22 14:47 . 2008-03-22 14:47 <DIR> d--hs---- C:\found.003
2008-03-22 02:40 . 2008-03-22 02:42 <DIR> d-------- C:\Program Files\eSoftware
2008-03-22 02:35 . 2008-03-22 11:53 6,656 --a------ C:\hlpr.exe
2008-03-20 12:36 . 2008-03-20 12:37 <DIR> d-------- C:\Program Files\VstPlugins
2008-03-20 12:30 . 2008-04-07 12:29 <DIR> d-------- C:\Program Files\Image-Line
2008-03-16 01:31 . 2008-03-16 01:31 <DIR> d-------- C:\WINDOWS\Recent
2008-03-16 01:31 . 2008-03-16 01:31 <DIR> d-------- C:\audio
2008-03-15 23:20 . 2008-04-08 18:49 <DIR> d-------- C:\Program Files\Audacity
2008-03-15 23:04 . 2008-03-16 03:19 <DIR> d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\Anvil Studio
2008-03-14 17:13 . 2008-04-03 14:45 28 --a------ C:\WINDOWS\ODBC.INI
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-12 14:47 --------- d-----w C:\Program Files\music_now
2008-04-12 13:47 --------- d-----w C:\Program Files\BPKL
2008-04-12 09:42 --------- d-----w C:\Program Files\BPK
2008-04-12 05:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-04-10 15:48 --------- d-----w C:\Program Files\iTunes
2008-04-10 15:38 --------- d-----w C:\Program Files\QuickTime
2008-04-10 01:00 --------- d-----w C:\Program Files\Hewlett-Packard
2008-04-10 00:53 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-04-10 00:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-04-09 16:43 --------- d-----w C:\Program Files\Ahead
2008-04-09 02:11 --------- d-----w C:\Program Files\Symantec
2008-04-09 01:42 --------- d-----w C:\Program Files\BitTorrent
2008-04-09 01:17 --------- d-----w C:\Program Files\HP
2008-04-08 23:51 --------- d-----w C:\Program Files\Xtreme Sound PCI
2008-04-08 23:35 1,827 --sha-r C:\WINDOWS\system32\drivers\103C_HP_CPC_RK513AA-ABA SR2032X NA680_YC_0Pres_QCNH635_E64NAemREA3_48_INAOS_SASUSTek Computer INC._V1.05_B3.00_T060630_WXP2_L409_M447_J200_7AMD_8Athlon 64_92.2_#061229_N_Z14F12F20_G10DE0241.MRK
2008-04-07 19:31 --------- d-----w C:\Program Files\Verizon
2008-04-02 18:13 --------- d-----w C:\Program Files\Soulseek
2008-03-30 00:27 --------- d-sh--w C:\Program Files\KGS
2008-03-25 11:36 --------- d-----w C:\Program Files\WinZip E-Mail Companion
2008-03-25 10:09 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-03-25 10:07 --------- d-----w C:\Program Files\MSN Messenger
2008-03-25 07:11 10,085 ----a-w C:\Program Files\hijackthis.log
2008-03-24 16:05 --------- d-----w C:\Program Files\ASMtr
2008-03-24 14:51 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-23 07:38 --------- d-----w C:\Program Files\LimeWire
2008-03-21 07:09 --------- d-----w C:\Program Files\Mario Forever
2008-03-15 04:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZipEC
2008-03-15 04:18 104 ----a-w C:\Program Files\Recycle Bin.lnk
2008-03-15 03:54 --------- d-----w C:\Program Files\Picasa2
2008-03-14 07:06 --------- d-----w C:\Documents and Settings\Compaq_Administrator\Application Data\Image Zone Express
2008-03-11 15:53 --------- d-----w C:\Program Files\Xtreme Sound Driver Setup
2008-03-08 23:05 --------- d-----w C:\Program Files\Apple Software Update
2008-03-03 15:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-29 04:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-02-29 04:11 --------- d-----w C:\Program Files\AOL 9.1
2008-02-29 04:11 --------- d-----w C:\Documents and Settings\Compaq_Administrator\Application Data\AOL
2008-02-29 04:10 --------- d-----w C:\Program Files\Common Files\aolshare
2008-02-29 04:10 --------- d-----w C:\Program Files\Common Files\AOL
2008-02-29 04:09 --------- d-----w C:\Program Files\Viewpoint
2008-02-29 04:09 --------- d-----w C:\Program Files\Common Files\Nullsoft
2008-02-29 04:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-02-29 04:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL OCP
2008-02-29 04:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2008-02-29 03:36 --------- d-----w C:\Program Files\Carbonite
2008-02-29 03:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Carbonite
2008-02-29 03:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2008-02-28 09:02 2,210 ----a-w C:\Documents and Settings\Compaq_Administrator\Application Data\wklnhst.dat
2008-02-25 03:48 --------- d-----w C:\Program Files\Disney
2008-02-19 09:09 --------- d-----w C:\Program Files\Common Files\ISPCOMP
2008-02-15 22:17 --------- d-----w C:\Program Files\TomTom HOME 2
2008-02-15 22:17 --------- d-----w C:\Program Files\TomTom HOME
2008-02-15 22:17 --------- d-----w C:\Documents and Settings\Compaq_Administrator\Application Data\TomTom
2008-02-15 22:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\TomTom
2007-04-26 03:59 390 ----a-w C:\Program Files\Shortcut to Program Files.lnk
2007-01-23 09:03 275,832,704 ----a-w C:\Program Files\AcroPro80_efg.exe
2007-03-02 09:31 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012007030220070303\index.dat
.
------- Sigcheck -------
2005-03-01 17:36 2056832 d8aba3eab509627e707a3b14f00fbb6b C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
2006-12-19 09:12 2059392 ba4b97c00a437c1cc3da365d93ee1e9d C:\WINDOWS\$hf_mig$\KB929338\SP2QFE\ntkrnlpa.exe
2007-02-28 02:15 2059392 4d3dbdccbf97f5ba1e74f322b155c3ba C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
2005-03-01 17:34 2056832 81013f36b21c7f72cf784cc6731e0002 C:\WINDOWS\$NtUninstallKB929338$\ntkrnlpa.exe
2006-12-19 05:55 2057600 1d659bfb788ed2ba45075624b748d249 C:\WINDOWS\$NtUninstallKB931784$\ntkrnlpa.exe
2007-02-28 01:38 2057600 515d30e2c90a3665a2739309334c9283 C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
2007-02-28 01:38 2057600 515d30e2c90a3665a2739309334c9283 C:\WINDOWS\system32\ntkrnlpa.exe
2005-03-01 18:04 2179456 28187802b7c368c0d3aef7d4c382aabb C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
2006-12-19 09:51 2182016 cef243f6defd20be4adde26c7ecacb54 C:\WINDOWS\$hf_mig$\KB929338\SP2QFE\ntoskrnl.exe
2007-02-28 02:55 2182144 5a5c8db4aa962c714c8371fbdf189fc9 C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
2005-03-01 17:59 2179328 4d4cf2c14550a4b7718e94a6e581856e C:\WINDOWS\$NtUninstallKB929338$\ntoskrnl.exe
2006-12-19 07:17 2180352 8f0deab1f81fb83f9c5995853ce48b9f C:\WINDOWS\$NtUninstallKB931784$\ntoskrnl.exe
2007-02-28 02:10 2180352 582a8dbaa58c3b1f176eb2817daee77c C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
2007-02-28 02:10 2180352 582a8dbaa58c3b1f176eb2817daee77c C:\WINDOWS\system32\ntoskrnl.exe
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 16:24 1694208]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 21:01 67584]
"ftutil2"="ftutil2.dll" [2004-06-07 14:05 106496 C:\WINDOWS\system32\ftutil2.dll]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-13 20:05 16239616 C:\WINDOWS\RTHDCPL.EXE]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-02 23:19 77312 C:\WINDOWS\arpwrmsg.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-09 15:50 7311360]
"nwiz"="nwiz.exe" [2006-05-09 15:50 1519616 C:\WINDOWS\system32\nwiz.exe]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 22:14 237568]
"PCDrProfiler"="" []
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 22:34 249856]
"Reminder"="C:\Windows\Creator\Remind_XP.exe" [2004-12-14 02:23 663552]
"C-Media Mixer"="Mixer.exe" [2002-10-15 18:00 1818624 C:\WINDOWS\mixer.exe]
"CmPCIaudio"="CMICNFG3.CPL" []
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-03-25 10:42 579072]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-08-14 15:56 180269]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-25 10:42 219136]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 05:05:26 29696]
Compaq Connections.lnk - C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe [2006-08-14 16:13:46 36903]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 05:21:22 288472]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2007-12-03 12:10:00 394856]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\DISC\\DISCover.exe"=
"C:\\Program Files\\DISC\\DiscStreamHub.exe"=
"C:\\Program Files\\DISC\\myFTP.exe"=
"C:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-04-10 15:34:38 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-04-13 01:29:34
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:01:12 AM, on 4/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\Mixer.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DISC\DISCover.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\DISC\DiscUpdMgr.exe
C:\Program Files\DISC\DiscStreamHub.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://ie.redirect.h...a...&pf=desktopR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://ie.redirect.h...a...&pf=desktopR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft....k/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft....k/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://ie.redirect.h...a...&pf=desktopR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft....k/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft....k/?LinkId=69157R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [CmPCIaudio] RunDll32 CMICNFG3.CPL,CMICtrlWnd
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone:
http://*.trymedia.com (HKLM)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
--
End of file - 7817 bytes
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-13 2:33:43
ComboFix-quarantined-files.txt 2008-04-13 09:33:27
ComboFix2.txt 2008-04-06 00:11:58
Pre-Run: 86,779,006,976 bytes free
Post-Run: 86,770,880,512 bytes free
.
2008-04-12 10:08:00 --- E O F ---