ComboFix 08-04-09.1 - ariel 2008-04-09 15:54:14.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.505 [GMT -4:00]
Running from: C:\Documents and Settings\ariel.PC621321097843\Temporary Internet Files\Content.IE5\8G7AO0RN\ComboFix[1].exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\ariel.PC621321097843\Application Data\SSTEM3~1
C:\Documents and Settings\ariel.PC621321097843\Application Data\SSTEM3~1\d?xplore.exe
C:\Documents and Settings\ariel.PC621321097843\My Documents\ICROSO~1
C:\Documents and Settings\ariel.PC621321097843\My Documents\ICROSO~1\?icrosoft\
C:\Documents and Settings\ariel.PC621321097843\Start Menu\Programs\Internet Speed Monitor
C:\Documents and Settings\ariel.PC621321097843\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk
C:\Documents and Settings\ariel.PC621321097843\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk
C:\Documents and Settings\ariel.PC621321097843\Start Menu\Programs\Outerinfo
C:\Documents and Settings\ariel.PC621321097843\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\ariel.PC621321097843\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\Program Files\Common Files\Yazzle1552OinAdmin.exe
C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe
C:\Program Files\FunWebProducts
C:\Program Files\FunWebProducts\ScreenSaver\Images\
007F9793.urr
C:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn-new.html
C:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn-new.html
C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
C:\Program Files\internet explorer\msimg32.dll
C:\Program Files\MyWebSearch
C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
C:\Program Files\MyWebSearch\bar\1.bin\F3BROVLY.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3SHLLVW.DLL
C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV
C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL
C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Cache\
0001366C
C:\Program Files\MyWebSearch\bar\Cache\
000170F5.bin
C:\Program Files\MyWebSearch\bar\Cache\
0001721E.bin
C:\Program Files\MyWebSearch\bar\Cache\
000172D9.bin
C:\Program Files\MyWebSearch\bar\Cache\
00017337.bin
C:\Program Files\MyWebSearch\bar\Cache\
000173F2.bin
C:\Program Files\MyWebSearch\bar\Cache\
00030272
C:\Program Files\MyWebSearch\bar\Cache\
00074842.bin
C:\Program Files\MyWebSearch\bar\Cache\
00079B05.bin
C:\Program Files\MyWebSearch\bar\Cache\
00079C3E.bin
C:\Program Files\MyWebSearch\bar\Cache\
00079DA5.bin
C:\Program Files\MyWebSearch\bar\Cache\
005D1AD6
C:\Program Files\MyWebSearch\bar\Cache\
005D1B82.bin
C:\Program Files\MyWebSearch\bar\Cache\files.ini
C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
C:\Program Files\MyWebSearch\bar\History\search2
C:\Program Files\MyWebSearch\bar\icons\CM.ICO
C:\Program Files\MyWebSearch\bar\icons\MFC.ICO
C:\Program Files\MyWebSearch\bar\icons\PSS.ICO
C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO
C:\Program Files\MyWebSearch\bar\icons\WB.ICO
C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO
C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Message\COMMON\ask_logo.gif
C:\Program Files\MyWebSearch\bar\Message\COMMON\autoup.gif
C:\Program Files\MyWebSearch\bar\Message\COMMON\autoup.htm
C:\Program Files\MyWebSearch\bar\Message\COMMON\center.htm
C:\Program Files\MyWebSearch\bar\Message\COMMON\index.htm
C:\Program Files\MyWebSearch\bar\Message\COMMON\mid_dots.gif
C:\Program Files\MyWebSearch\bar\Message\COMMON\mws_logo.gif
C:\Program Files\MyWebSearch\bar\Message\COMMON\protect.htm
C:\Program Files\MyWebSearch\bar\Message\COMMON\shocked.gif
C:\Program Files\MyWebSearch\bar\Message\COMMON\stop.gif
C:\Program Files\MyWebSearch\bar\Message\COMMON\systray.htm
C:\Program Files\MyWebSearch\bar\Message\COMMON\systrayp.htm
C:\Program Files\MyWebSearch\bar\Message\COMMON\tp_grad.gif
C:\Program Files\MyWebSearch\bar\Message\COMMON\warn.gif
C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S
C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S
C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S
C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S
C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S
C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S
C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S
C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S
C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S
C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S
C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
C:\Program Files\MyWebSearch\bar\Settings\setting2.htm
C:\Program Files\MyWebSearch\bar\Settings\settings.dat
C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
C:\Program Files\Sysmnt
C:\WINDOWS\system32\
000060.exe
C:\WINDOWS\system32\
000080.exe
C:\WINDOWS\system32\
000090.exe
D:\Autorun.inf
----- BITS: Possible infected sites -----
hxxp://80.93.48.74
.
((((((((((((((((((((((((( Files Created from 2008-03-09 to 2008-04-09 )))))))))))))))))))))))))))))))
.
2008-04-07 18:16 . 2008-04-07 18:16 <DIR> d-------- C:\Documents and Settings\ariel.PC621321097843\Application Data\CyberLink
2008-04-07 18:15 . 2008-04-07 18:15 <DIR> d-------- C:\Documents and Settings\ariel.PC621321097843\Application Data\HP
2008-04-06 16:38 . 2008-04-06 16:38 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-06 14:38 . 2008-04-06 16:33 <DIR> d--hs---- C:\Documents and Settings\ariel.PC621321097843\Temporary Internet Files
2008-04-06 14:38 . 2008-04-06 14:39 <DIR> d--hs---- C:\Documents and Settings\ariel.PC621321097843\History
2008-04-06 14:38 . 2008-04-06 14:38 1,674 -rahs---- C:\WINDOWS\system32\drivers\103C_HP_NTBK_HP Pavilion dv2000 (RG408UA#ABA)_YN_0Pavi_Q2CE6450K10_E433352003_46_I30B5_SWistron_V62.57_BF.34_T07
0602_WXP2_L409_M959_J120_7AMD_8Turion 64 X2_91.61_#061113_N14E44311_(RG408UA#ABA)_XMOBILE_CN10_Z_2F.34.MRK
2008-04-06 14:37 . 2006-11-13 23:11 <DIR> d-------- C:\Documents and Settings\ariel.PC621321097843\Application Data\Intuit
2008-04-06 14:12 . 2008-04-06 14:12 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-04-06 13:40 . 2008-04-07 18:19 51,690 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k0
2008-04-06 13:40 . 2008-04-07 18:19 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k7
2008-04-06 13:40 . 2008-04-07 18:19 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k6
2008-04-06 13:40 . 2008-04-07 18:19 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k5
2008-04-06 13:40 . 2008-04-07 18:19 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k4
2008-04-06 13:40 . 2008-04-07 18:19 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k3
2008-04-06 13:40 . 2008-04-07 18:19 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k2
2008-04-06 13:40 . 2008-04-07 18:19 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k1
2008-04-06 12:30 . 2008-04-09 15:30 <DIR> d-------- C:\WINDOWS\CAVTemp
2008-04-06 12:25 . 2008-04-06 12:25 <DIR> d-------- C:\Program Files\Common Files\Scanner
2008-04-06 12:25 . 2008-04-06 12:25 <DIR> d-------- C:\Program Files\CA
2008-04-06 12:25 . 2008-04-06 12:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\CA
2008-04-06 12:25 . 2007-08-20 13:38 879,784 --a------ C:\WINDOWS\system32\drivers\vetefile.sys
2008-04-06 12:25 . 2007-08-20 13:38 108,312 --a------ C:\WINDOWS\system32\drivers\veteboot.sys
2008-04-06 12:25 . 2007-08-20 13:37 99,592 --a------ C:\WINDOWS\system32\isafeif.dll
2008-04-06 12:25 . 2007-08-20 13:26 79,424 --a------ C:\WINDOWS\system32\vetredir.dll
2008-04-06 12:25 . 2007-08-20 13:37 75,016 --a------ C:\WINDOWS\system32\isafprod.dll
2008-04-06 12:25 . 2007-08-20 13:38 32,264 --a------ C:\WINDOWS\system32\drivers\vetmonnt.sys
2008-04-06 12:25 . 2007-08-20 13:38 26,376 --a------ C:\WINDOWS\system32\drivers\vet-filt.sys
2008-04-06 12:25 . 2007-08-20 13:38 21,512 --a------ C:\WINDOWS\system32\drivers\vetfddnt.sys
2008-04-06 12:25 . 2007-08-20 13:38 21,128 --a------ C:\WINDOWS\system32\drivers\vet-rec.sys
2008-04-06 11:51 . 2008-04-06 11:51 <DIR> d-------- C:\Program Files\QuickPar
2008-04-06 11:37 . 2008-04-06 11:37 94,208 --a------ C:\WINDOWS\system32\anajcjob.exe
2008-04-06 11:31 . 2008-04-06 11:31 127 --a------ C:\WINDOWS\system32\MRT.INI
2008-04-06 11:29 . 2008-04-06 11:53 <DIR> d-------- C:\Documents and Settings\ariel.PC621321097843\Downloads
2008-04-06 11:29 . 2008-04-06 11:32 <DIR> d-------- C:\Documents and Settings\ariel.PC621321097843\Application Data\NewsLeecher
2008-04-06 11:29 . 2006-08-21 05:14 128,896 --------- C:\WINDOWS\system32\dllcache\fltmgr.sys
2008-04-06 11:29 . 2006-08-21 05:14 23,040 --------- C:\WINDOWS\system32\dllcache\fltmc.exe
2008-04-06 11:29 . 2006-08-21 08:21 16,896 --------- C:\WINDOWS\system32\dllcache\fltlib.dll
2008-04-06 11:20 . 2008-04-06 11:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Rabio
2008-04-06 11:18 . 2008-04-06 11:18 <DIR> d-------- C:\WINDOWS\uprjiefj
2008-04-06 11:18 . 2008-04-06 11:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\bejgjufg
2008-04-06 11:17 . 2008-04-06 11:20 <DIR> d-------- C:\Program Files\Bat
2008-04-06 11:17 . 2008-04-06 11:17 91,561 --a------ C:\WINDOWS\system32\wmsdkns.exe
2008-04-06 11:17 . 2008-04-06 11:17 6,656 --a------ C:\WINDOWS\ions.dll
2008-04-06 11:13 . 2008-04-06 11:13 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-04-06 11:09 . 2008-04-06 11:27 <DIR> d-------- C:\Documents and Settings\ariel.PC621321097843\Application Data\Yahoo!
2008-04-06 11:06 . 2007-07-09 09:09 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-04-06 10:59 . 2006-12-07 00:14 2,330,624 --------- C:\WINDOWS\system32\dllcache\wmvcore.dll
2008-04-06 10:59 . 2006-10-12 07:54 256,512 --------- C:\WINDOWS\system32\dllcache\agentsvr.exe
2008-04-06 10:59 . 2007-03-09 09:58 57,344 --a------ C:\WINDOWS\system32\dllcache\agentdpv.dll
2008-04-06 10:59 . 2006-10-12 09:54 42,496 --------- C:\WINDOWS\system32\dllcache\agentdp2.dll
2008-04-06 10:56 . 2008-04-06 10:56 <DIR> d-------- C:\Documents and Settings\ariel.PC621321097843\Application Data\DAEMON Tools Pro
2008-03-23 22:35 . 2008-03-23 22:35 1,158 --a------ C:\WINDOWS\mozver.dat
2008-03-22 21:09 . 2008-03-22 21:09 <DIR> d--hs---- C:\WINDOWS\ftpcache
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-06 18:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\WildTangent
2008-04-06 18:38 1,674 --sha-r C:\WINDOWS\system32\drivers\103C_HP_NTBK_HP Pavilion dv2000 (RG408UA#ABA)_YN_0Pavi_Q2CE6450K10_E433352003_46_I30B5_SWistron_V62.57_BF.34_T07
0602_WXP2_L409_M959_J120_7AMD_8Turion 64 X2_91.61_#061113_N14E44311_(RG408UA#ABA)_XMOBILE_CN10_Z_2F.34.MRK
2008-04-06 18:33 --------- d-----w C:\Program Files\HPQ
2008-04-06 17:09 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-04-06 17:08 --------- d-----w C:\Program Files\RGB
2008-04-06 17:08 --------- d-----w C:\Program Files\Quickensetup
2008-04-06 17:06 --------- d-----w C:\Program Files\NetWaiting
2008-04-06 17:05 --------- d-----w C:\Program Files\music_now
2008-04-06 17:05 --------- d-----w C:\Program Files\Microsoft Works
2008-04-06 17:04 --------- d-----w C:\Program Files\Microsoft Office Trial Wizard
2008-04-06 17:03 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-06 16:57 --------- d-----w C:\Program Files\GemMaster
2008-04-06 16:57 --------- d-----w C:\Program Files\EnglishOtto
2008-04-06 16:57 --------- d-----w C:\Program Files\Encarta Online
2008-04-06 16:57 --------- d-----w C:\Program Files\DivX
2008-04-06 16:57 --------- d-----w C:\Program Files\CONEXANT
2008-04-06 16:57 --------- d-----w C:\Program Files\Common Files\SureThing Shared
2008-04-06 16:57 --------- d-----w C:\Program Files\Common Files\Sonic Shared
2008-04-06 16:56 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-04-06 16:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sonic
2008-04-06 16:47 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Symantec
2008-04-06 15:34 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-04-06 15:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-04-06 15:29 --------- d-----w C:\Program Files\NewsLeecher
2008-04-06 15:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-04-06 14:54 --------- d-----w C:\Program Files\Quicken
2008-03-22 23:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-03-22 23:13 --------- d-----w C:\Program Files\EA GAMES
2008-03-22 23:02 --------- d-----w C:\Program Files\JoWooD
2008-02-23 14:25 --------- d-----w C:\Program Files\Crazy Machines
2008-02-23 01:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia
2008-02-23 01:13 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2008-02-23 01:13 --------- d-----w C:\Program Files\Real
2008-02-23 01:13 --------- d-----w C:\Program Files\Common Files\Real
2008-02-19 20:49 --------- d-----w C:\Program Files\Common Files\AOL
2008-02-19 20:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-02-17 22:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\NannyMania
2008-02-17 22:49 --------- d-----w C:\Program Files\NannyMania_at
2008-02-17 22:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\TEMP
2005-09-24 15:49 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3B45C1BD-5306-7FFF-0A60-2F00C9B48E98}]
C:\WINDOWS\system32\hdbtm.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{63F7460B-C831-4142-A4AA-5EC303EC4343}]
2008-03-07 21:15 413696 --a------ C:\Program Files\Bat\Bat.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8334A30C-49E5-489a-B63D-5B927C1EF46E}]
C:\Program Files\QdrDrive\QdrDrive15.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]
"Scbu"="C:\DOCUME~1\ARIEL~1.PC6\MYDOCU~1\ICROSO~1\winspool.exe" [ ]
"QdrModule15"="C:\Program Files\QdrModule\QdrModule15.exe" [ ]
"Ekh"="C:\Documents and Settings\ariel.PC621321097843\Application Data\s?stem32\d?xplore.exe" [ ]
"ngdshcuh"="C:\WINDOWS\system32\anajcjob.exe" [2008-04-06 11:37 94208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-16 00:00 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-06 00:56 64512]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-04 01:58 458752]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-11 00:03 36975]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-24 14:40 7569408]
"MsmqIntCert"="regsvr32 /s mqrt.dll" []
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-04-18 07:29 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-06-17 01:22 794713]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2006-07-12 01:55 102400]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 03:11 49152]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 20:30 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 20:30 81920]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 15:33 163840]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2006-01-26 20:18 40960]
"RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 14:23 1187840]
"cctray"="C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [2007-08-16 22:19 177416]
"QOELOADER"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe" [2008-04-06 12:25 14088]
"CAVRID"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2007-08-20 13:36 230664]
"cafwc"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe" [2008-02-05 11:19 1193224]
"capfasem"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe" [2008-02-05 11:19 173320]
"capfupgrade"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe" [2008-02-05 11:19 259336]
"CaPPcl"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAAntiSpyware.exe" [2007-08-16 21:10 410888]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 02:05:26 29696]
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 12:39:30 73728]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"21w1NPiWL1"= C:\Documents and Settings\All Users\Application Data\bejgjufg\vmvqjgzc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW]
UmxWnp.Dll 2007-05-18 13:30 79368 C:\WINDOWS\system32\UmxWNP.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent]
--a------ 2007-09-06 09:08 136136 C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Windows Installer]
--a------ 2008-04-06 11:18 183248 C:\DOCUME~1\ARIEL~1.PC6\LOCALS~1\Temp\ie.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyHunter Security Suite]
--a------ 2008-01-23 14:47 847872 C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\CA Personal Firewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\mqsvc.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
R0 KmxStart;KmxStart;C:\WINDOWS\system32\DRIVERS\kmxstart.sys [2007-10-18 10:24]
R1 KmxAgent;KmxAgent;C:\WINDOWS\system32\DRIVERS\kmxagent.sys [2007-05-18 13:30]
R1 KmxFile;KmxFile;C:\WINDOWS\system32\DRIVERS\KmxFile.sys [2007-05-18 13:30]
R1 KmxFw;KmxFw;C:\WINDOWS\system32\DRIVERS\kmxfw.sys [2007-10-18 14:21]
R2 KmxCF;KmxCF;C:\WINDOWS\system32\DRIVERS\KmxCF.sys [2007-10-18 10:24]
R2 KmxSbx;KmxSbx;C:\WINDOWS\system32\DRIVERS\KmxSbx.sys [2007-11-02 12:09]
R2 UmxAgent;HIPS Event Manager;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe" [2007-10-18 10:24]
R2 UmxCfg;HIPS Configuration Interpreter;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe" [2007-10-18 10:24]
R2 UmxPol;HIPS Policy Manager;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe" [2007-05-18 13:30]
R3 KmxCfg;KmxCfg;C:\WINDOWS\system32\DRIVERS\kmxcfg.sys [2007-09-13 15:15]
R3 nvsmu;nvsmu;C:\WINDOWS\system32\DRIVERS\nvsmu.sys [2006-03-06 10:49]
R3 PPCtlPriv;PPCtlPriv;"C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe" [2007-08-16 21:10]
*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-04-06 17:30:59 C:\WINDOWS\Tasks\CAAntiSpywareScan_Daily as ariel at 12 25 PM.job"
- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAAntiSpyware.exe
.
**************************************************************************
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-04-09 15:57:28
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ???@X????????@???????@
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-09 15:58:15
ComboFix-quarantined-files.txt 2008-04-09 19:58:09
Pre-Run: 88,749,670,400 bytes free
Post-Run: 88,929,628,160 bytes free
.
2008-04-06 19:48:00 --- E O F ---
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:02:26 PM, on 4/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
C:\Documents and Settings\All Users\Application Data\bejgjufg\vmvqjgzc.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
C:\Documents and Settings\ariel.PC621321097843\Application Data\s?stem32\d?xplore.exe
C:\WINDOWS\system32\anajcjob.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\Bat\X_Bat.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft....k/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft....k/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://us.rd.yahoo.c...rch/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft....k/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft....k/?LinkId=69157R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
http://us.rd.yahoo.c...//www.yahoo.comR1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://ie.redirect.h...a...n&pf=laptopR3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3B45C1BD-5306-7FFF-0A60-2F00C9B48E98} - C:\WINDOWS\system32\hdbtm.dll (file missing)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: BatBHO - {63F7460B-C831-4142-A4AA-5EC303EC4343} - C:\Program Files\Bat\Bat.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: StFlex IE Helper - {8334A30C-49E5-489a-B63D-5B927C1EF46E} - C:\Program Files\QdrDrive\QdrDrive15.dll (file missing)
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [cafwc] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [capfasem] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
O4 - HKLM\..\Run: [capfupgrade] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
O4 - HKLM\..\Run: [CaPPcl] C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAAntiSpyware.exe /scan /startup
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Scbu] "C:\DOCUME~1\ARIEL~1.PC6\MYDOCU~1\ICROSO~1\winspool.exe" -vt yazb
O4 - HKCU\..\Run: [QdrModule15] "C:\Program Files\QdrModule\QdrModule15.exe"
O4 - HKCU\..\Run: [Ekh] "C:\Documents and Settings\ariel.PC621321097843\Application Data\s?stem32\d?xplore.exe"
O4 - HKCU\..\Run: [ngdshcuh] C:\WINDOWS\system32\anajcjob.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [21w1NPiWL1] C:\Documents and Settings\All Users\Application Data\bejgjufg\vmvqjgzc.exe
O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O4 - Startup: Bat - Auto Update.lnk = C:\Program Files\Bat\Bat.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
--
End of file - 10661 bytes