Hey thanks for the quick reply, Here's the log files u asked for, Though I don't know why it deleted some of my mastercam X files. maybe u could tell me why and what i should do cause I use that program for work.
ComboFix 08-04-12.10 - RYAN 2008-04-13 14:13:23.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.167 [GMT -4:00]
Running from: C:\Documents and Settings\RYAN\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\Router
C:\Program Files\Router\OPS\Router_Inch.DEFAULTS
C:\Program Files\Router\OPS\Router_Inch.OPERATIONS
C:\Program Files\Router\OPS\Router_MM.DEFAULTS
C:\Program Files\Router\OPS\Router_MM.OPERATIONS
C:\Program Files\Router\POSTS\Generic Fanuc 3X Router.pst
C:\Program Files\Router\POSTS\Generic Fanuc 4X Router.pst
C:\Program Files\Router\POSTS\Generic Fanuc 5X Router.psb
C:\Program Files\Router\POSTS\Generic Fanuc 5X Router.pst
C:\Program Files\Router\POSTS\MPROUTER.pst
C:\Program Files\Router\POSTS\Router.SET
C:\Program Files\Router\POSTS\RouterM.SET
C:\Program Files\Router\Template\Door Demo.xls
C:\Program Files\Router\Tools\BOREBAR.MCX
C:\Program Files\Router\Tools\BULLMILL.MCX
C:\Program Files\Router\Tools\CHMFMILL.MCX
C:\Program Files\Router\Tools\CTRBORE.MCX
C:\Program Files\Router\Tools\CTRDRILL.MCX
C:\Program Files\Router\Tools\CTRSINK.MCX
C:\Program Files\Router\Tools\DOVEMILL.MCX
C:\Program Files\Router\Tools\DRILL.MCX
C:\Program Files\Router\Tools\FACEMILL.MCX
C:\Program Files\Router\Tools\FLATMILL.MCX
C:\Program Files\Router\Tools\FLUTDRIL.MCX
C:\Program Files\Router\Tools\HOLDER.MCX
C:\Program Files\Router\Tools\LOLLIPOP.MCX
C:\Program Files\Router\Tools\MATLS.MATERIALS
C:\Program Files\Router\Tools\RADMILL.MCX
C:\Program Files\Router\Tools\REAMER.MCX
C:\Program Files\Router\Tools\Router_INCH.TOOLS
C:\Program Files\Router\Tools\Router_MM.TOOLS
C:\Program Files\Router\Tools\sample.hd9
C:\Program Files\Router\Tools\SLOTMILL.MCX
C:\Program Files\Router\Tools\SPHERMIL.MCX
C:\Program Files\Router\Tools\SPOTDRIL.MCX
C:\Program Files\Router\Tools\TAPERMIL.MCX
C:\Program Files\Router\Tools\TAPLH.MCX
C:\Program Files\Router\Tools\TAPRH.MCX
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\awtqoLdc.dll
C:\WINDOWS\system32\bfrdhftg.dll
C:\WINDOWS\system32\bodrhqnx.dll
C:\WINDOWS\system32\bpjxjfif.ini
C:\WINDOWS\system32\byurjscl.dll
C:\WINDOWS\system32\cdLoqtwa.ini
C:\WINDOWS\system32\cdLoqtwa.ini2
C:\WINDOWS\system32\djxnxhkv.ini
C:\WINDOWS\system32\dxieijdp.dll
C:\WINDOWS\system32\ehxhercp.dll
C:\WINDOWS\system32\flyjxpio.dll
C:\WINDOWS\system32\htpywkik.ini
C:\WINDOWS\system32\lewegtpr.ini
C:\WINDOWS\system32\lfpioujc.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\oabvrimt.ini
C:\WINDOWS\system32\ofoujijp.dll
C:\WINDOWS\system32\rptgewel.dll
C:\WINDOWS\system32\sbmcvjna.ini
C:\WINDOWS\system32\skaciedv.dll
C:\WINDOWS\system32\thamskbp.ini
C:\WINDOWS\system32\tmirvbao.dll
C:\WINDOWS\system32\vkhxnxjd.dll
C:\WINDOWS\system32\vkplhbvx.dll
C:\WINDOWS\system32\vqsamwph.ini
C:\WINDOWS\system32\xnujcous.dll
C:\WINDOWS\system32\xyxbIRqr.ini
C:\WINDOWS\system32\xyxbIRqr.ini2
.
((((((((((((((((((((((((( Files Created from 2008-03-13 to 2008-04-13 )))))))))))))))))))))))))))))))
.
2008-04-13 04:24 . 2008-04-13 04:24 <DIR> d-------- C:\Program Files\Google
2008-04-13 00:44 . 2008-04-13 00:45 <DIR> d-------- C:\Highjackthis
2008-04-12 16:08 . 2008-04-12 16:08 3,648 --a------ C:\WINDOWS\system32\hobiqxqm.dll
2008-04-12 01:41 . 2008-04-12 02:07 <DIR> d-------- C:\VundoFix Backups
2008-04-11 23:00 . 2008-04-13 14:26 114,724 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k0
2008-04-11 23:00 . 2008-04-13 14:26 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k7
2008-04-11 23:00 . 2008-04-13 14:26 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k6
2008-04-11 23:00 . 2008-04-13 14:26 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k5
2008-04-11 23:00 . 2008-04-13 14:26 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k4
2008-04-11 23:00 . 2008-04-13 14:26 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k3
2008-04-11 23:00 . 2008-04-13 14:26 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k2
2008-04-11 23:00 . 2008-04-13 14:26 64 --a------ C:\WINDOWS\system32\drivers\kmxcfg.u2k1
2008-04-11 22:24 . 2008-04-11 22:24 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-11 21:46 . 2008-04-12 16:12 <DIR> d-------- C:\Documents and Settings\RYAN\Application Data\CallingID
2008-04-11 21:38 . 2008-04-11 22:40 <DIR> d-------- C:\Documents and Settings\RYAN\Application Data\GetRightToGo
2008-04-11 19:38 . 2008-04-13 12:36 <DIR> d-------- C:\Program Files\Mozilla Firefox 3 Beta 5
2008-04-11 16:04 . 2008-04-11 16:04 3,648 --a------ C:\WINDOWS\system32\vdcgkjed.dll
2008-04-10 15:26 . 2008-04-10 15:26 3,648 --a------ C:\WINDOWS\system32\igbfscvw.dll
2008-04-09 15:26 . 2008-04-09 15:26 3,648 --a------ C:\WINDOWS\system32\trndvhrb.dll
2008-04-08 15:26 . 2008-04-08 15:26 3,648 --a------ C:\WINDOWS\system32\uixjguru.dll
2008-04-08 04:28 . 2004-08-03 23:04 156,672 --a--c--- C:\WINDOWS\system32\dllcache\winzm.ime
2008-04-08 04:28 . 2004-08-03 23:04 156,672 --a--c--- C:\WINDOWS\system32\dllcache\winsp.ime
2008-04-08 04:28 . 2004-08-03 23:04 156,672 --a--c--- C:\WINDOWS\system32\dllcache\winpy.ime
2008-04-08 04:28 . 2004-08-03 23:04 79,360 --a--c--- C:\WINDOWS\system32\dllcache\winar30.ime
2008-04-08 04:28 . 2001-08-23 12:00 69,120 --a--c--- C:\WINDOWS\system32\dllcache\wingb.ime
2008-04-08 04:28 . 2004-08-03 23:04 65,536 --a--c--- C:\WINDOWS\system32\dllcache\winime.ime
2008-04-08 04:28 . 2001-08-23 12:00 28,288 --a--c--- C:\WINDOWS\system32\dllcache\xjis.nls
2008-04-08 04:26 . 2001-08-23 12:00 1,875,968 --a--c--- C:\WINDOWS\system32\dllcache\msir3jp.lex
2008-04-08 04:25 . 2001-08-23 12:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-04-08 04:24 . 2001-08-23 12:00 1,677,824 --a--c--- C:\WINDOWS\system32\dllcache\chsbrkr.dll
2008-04-08 04:23 . 2004-08-04 00:56 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\smtpsnap.dll
2008-04-08 04:22 . 2004-08-04 00:56 290,816 --a--c--- C:\WINDOWS\system32\dllcache\adsiis51.dll
2008-04-08 04:16 . 2008-04-08 04:16 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-04-08 04:15 . 2008-04-08 04:15 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-04-08 04:15 . 2008-04-08 04:15 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-04-08 04:15 . 2008-04-08 04:15 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-04-08 04:15 . 2008-04-08 04:15 749 -rah----- C:\WINDOWS\system32\nwc.cpl.manifest
2008-04-08 04:15 . 2008-04-08 04:15 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-04-08 04:10 . 2004-08-04 00:56 152,576 --a------ C:\WINDOWS\system32\irftp.exe
2008-04-08 04:10 . 2004-08-03 23:00 87,424 --a------ C:\WINDOWS\system32\drivers\irda.sys
2008-04-08 04:10 . 2004-08-04 00:56 27,136 --a------ C:\WINDOWS\system32\irmon.dll
2008-04-08 04:10 . 2004-08-04 00:56 8,192 --a------ C:\WINDOWS\system32\wshirda.dll
2008-04-08 04:03 . 2001-08-17 13:51 19,584 --a------ C:\WINDOWS\system32\drivers\rasirda.sys
2008-04-08 03:57 . 2004-08-04 01:57 1,086,058 -ra------ C:\WINDOWS\SET33.tmp
2008-04-08 03:57 . 2004-08-04 02:03 1,042,903 -ra------ C:\WINDOWS\SET30.tmp
2008-04-08 03:31 . 2004-08-04 00:56 71,680 --a--c--- C:\WINDOWS\system32\dllcache\blastcln.exe
2008-04-08 03:31 . 2004-08-04 00:56 71,680 --a------ C:\WINDOWS\system32\blastcln.exe
2008-04-08 03:31 . 2004-08-04 00:56 17,408 --a------ C:\WINDOWS\system32\winshfhc.dll
2008-04-08 03:31 . 2004-08-04 00:56 17,408 --a--c--- C:\WINDOWS\system32\dllcache\winshfhc.dll
2008-04-08 03:31 . 2004-08-04 00:56 15,360 --a--c--- C:\WINDOWS\system32\dllcache\msgrocm.dll
2008-04-08 03:29 . 2004-08-04 00:56 2,897,920 --a------ C:\WINDOWS\system32\xpsp2res.dll
2008-04-08 03:27 . 2001-08-23 12:00 13,107,200 --a------ C:\WINDOWS\system32\oembios.bin
2008-04-08 03:26 . 2004-08-03 22:33 4,190,352 --a--c--- C:\WINDOWS\system32\dllcache\luna.mst
2008-04-08 03:25 . 2004-08-04 00:56 2,067,968 --a--c--- C:\WINDOWS\system32\dllcache\cdosys.dll
2008-04-04 19:23 . 2008-04-04 19:23 <DIR> d-------- C:\Documents and Settings\RYAN\Application Data\Talkback
2008-04-01 14:39 . 2008-04-01 14:39 294 --ahs---- C:\WINDOWS\system32\mitjfjnv.ini
2008-03-31 14:39 . 2008-04-01 02:48 1,597,474 --ahs---- C:\WINDOWS\system32\pywuavka.ini
2008-03-31 14:07 . 2008-03-31 14:31 1,597,654 --ahs---- C:\WINDOWS\system32\xinxnoxv.ini
2008-03-31 14:07 . 2008-03-31 14:07 1,597,174 --ahs---- C:\WINDOWS\system32\gwyvrqpk.ini
2008-03-31 05:45 . 2008-04-02 02:01 1,606,282 --ahs---- C:\WINDOWS\system32\iogqttat.ini
2008-03-30 05:41 . 2008-03-31 05:42 1,582,318 --ahs---- C:\WINDOWS\system32\ncshprlb.ini
2008-03-29 18:42 . 2008-03-29 18:43 1,583,697 --ahs---- C:\WINDOWS\system32\anscmenh.ini
2008-03-28 17:08 . 2008-03-30 14:49 1,583,877 --ahs---- C:\WINDOWS\system32\limxlxhr.ini
2008-03-28 17:02 . 2008-04-13 14:04 101,157 --a------ C:\WINDOWS\BM07468031.xml
2008-03-28 04:54 . 2008-03-27 13:59 9,296 --a------ C:\Documents and Settings\RYAN\serial.exe
2008-03-28 04:54 . 2008-02-12 15:45 48 --a------ C:\Documents and Settings\RYAN\readme.bat
2008-03-14 02:52 . 2008-03-14 02:52 <DIR> d-------- C:\Program Files\Pro Imaging Powertoys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-09 05:37 --------- d-----w C:\Program Files\dvdSanta
2008-04-08 05:32 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-06 05:42 --------- d-----w C:\Documents and Settings\RYAN\Application Data\uTorrent
2008-03-18 05:05 --------- d-----w C:\Program Files\Java
2008-03-07 09:12 --------- d-----w C:\Program Files\Rollercoaster Tycoon 3 + Soaked + Wild + Patch
2008-03-07 08:50 --------- d-----w C:\Program Files\Common Files\PocketSoft
2008-03-07 08:42 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-03-07 08:02 --------- d-----w C:\Program Files\DAEMON Tools Lite
2008-03-07 07:52 --------- d-----w C:\Program Files\DAEMON Tools Pro
2008-03-07 07:50 --------- d-----w C:\Documents and Settings\RYAN\Application Data\DAEMON Tools Pro
2008-03-07 07:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro
2008-03-07 07:14 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-03-07 07:13 --------- d-----w C:\Documents and Settings\RYAN\Application Data\DAEMON Tools
2008-03-07 06:44 --------- d-----w C:\Documents and Settings\RYAN\Application Data\Atari
2008-03-06 05:07 --------- d-----w C:\Documents and Settings\Mark\Application Data\Apple Computer
2008-03-05 01:10 --------- d-----w C:\Documents and Settings\Guest\Application Data\Nero
2008-03-04 06:29 3,280 ----a-w C:\WINDOWS\system32\tmp.reg
2008-02-24 04:14 --------- d-----w C:\Program Files\Padus
2008-02-24 01:29 --------- d-----w C:\Program Files\Common Files\Nero
2008-02-24 01:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-02-23 16:16 --------- d-----w C:\Documents and Settings\RYAN\Application Data\Media Player Classic
2008-02-23 05:29 --------- d-----w C:\Program Files\UseNeXT
2008-02-23 05:25 --------- d-----w C:\Documents and Settings\RYAN\Application Data\UseNeXT
2008-02-22 22:58 --------- d-----w C:\Program Files\uTorrent
2008-02-22 21:15 --------- d-----w C:\Documents and Settings\Mark\Application Data\Nero
2008-02-19 00:09 --------- d-----w C:\Program Files\NeroInstall.bak
2008-02-18 23:40 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-02-16 23:25 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-02-02 05:55 83,456 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-01-31 21:24 99,592 ----a-w C:\WINDOWS\system32\isafeif.dll
2008-01-31 21:24 91,400 ----a-w C:\WINDOWS\system32\isafprod.dll
2008-01-31 21:24 83,256 ----a-w C:\WINDOWS\system32\vetredir.dll
2008-01-29 07:53 612,864 ----a-w C:\WINDOWS\system32\x264vfw.dll
2008-01-27 19:37 81,920 ----a-w C:\WINDOWS\system32\IEDFix.exe
2005-08-17 20:57 647,456 ----a-w C:\Program Files\HaspX.exe
2005-08-17 20:57 155,816 ----a-w C:\Program Files\haspinfo.exe
2005-08-16 23:08 22 ----a-w C:\Program Files\engrave.acc
2005-08-16 22:59 22 ----a-w C:\Program Files\CATV5OUT.ACC
2005-08-16 21:10 23,552 ----a-w C:\Program Files\haspms32.dll
2005-08-16 16:23 22 ----a-w C:\Program Files\CATV4.ACC
2005-08-16 15:37 22 ----a-w C:\Program Files\CATV5IN.ACC
2005-08-16 15:24 22 ----a-w C:\Program Files\PROE.ACC
2005-08-13 17:58 4,397,192 ----a-w C:\Program Files\mastercam.exe
2005-07-08 20:23 1,725,952 ----a-w C:\Program Files\MCPost.dll
2005-07-07 19:22 659,456 ----a-w C:\Program Files\NHaspX.exe
2005-07-07 11:39 60,607 ----a-w C:\Program Files\Mastercam.ft
2005-07-07 11:27 85,660 ----a-w C:\Program Files\Thread.tbl
2005-07-07 11:27 6,360 ----a-w C:\Program Files\RGMetric.tbl
2005-07-07 11:27 550 ----a-w C:\Program Files\Mcomm.txt
2005-07-07 11:27 34,191 ----a-w C:\Program Files\Allowan.tbl
2005-07-07 11:27 26,478 ----a-w C:\Program Files\Mcomm.exe
2005-07-07 11:27 23,572,480 ----a-w C:\Program Files\PSKernel.dll
2005-07-07 11:27 181,222 ----a-w C:\Program Files\nethook.xml
2005-07-07 11:27 17,647 ----a-w C:\Program Files\MLICENSE.TXB
2005-07-07 11:27 13,810 ----a-w C:\Program Files\RGInch.tbl
2005-07-07 11:27 1,609,728 ----a-w C:\Program Files\N32DLL.DLL
2005-07-07 11:27 1,452 ----a-w C:\Program Files\Insert.tbl
2005-07-07 11:27 1,105,920 ----a-w C:\Program Files\psbodyshop.dll
2000-09-27 21:08 3,639 ----a-w C:\Program Files\nethasp.ini
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-09-20 16:35 202024]
"WinColorReminder"="C:\Program Files\Pro Imaging Powertoys\Microsoft Color Control Panel Applet for Windows XP\WinColorReminder.exe" [2005-10-31 11:30 101120]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-04-01 18:35 3587120]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dvd43"="C:\Program Files\dvd43\dvd43_tray.exe" [2006-05-22 14:26 694272]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2003-06-24 15:34 126976]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2003-06-24 15:33 561152]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 10:51 1836328]
"GhostStartTrayApp"="C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe" [2002-08-14 16:21 94208]
"RegistryMechanic"="" []
"cctray"="C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [2008-01-25 12:40 181512]
"CAVRID"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2008-01-31 17:24 234760]
"CaPPcl"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAAntiSpyware.exe" [2008-01-31 17:24 455944]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-04 15:18 267048]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 16:57 153136]
"QOELOADER"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.32\QOELoader.exe" [2008-04-11 21:45 14088]
"cafw"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe" [2008-01-24 16:43 771336]
"capfasem"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe" [2008-01-24 16:43 173320]
"capfupgrade"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe" [2008-01-24 16:43 259336]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:56 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{1869181A-9F50-4FCF-8BFF-1B8588ECB85C}"= C:\Program Files\CA\CA Internet Security Suite\CA Website Inspector\WebsiteInspector\LinkAdvisor\CIDLinkAdvisor.dll [2007-10-15 21:40 1373624]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfDtTll]
khfDtTll.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW]
UmxWnp.Dll 2007-05-18 13:30 79368 C:\WINDOWS\system32\UmxWNP.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\CA Personal Firewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN\\MSNCoreFiles\\Install\\msnsusii.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"=
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
R0 KmxStart;KmxStart;C:\WINDOWS\system32\DRIVERS\kmxstart.sys [2007-10-18 10:24]
R1 GhPciScan;GhostPciScanner;C:\Program Files\Symantec\Norton Ghost 2003\ghpciscan.sys [2002-08-14 16:11]
R1 KmxAgent;KmxAgent;C:\WINDOWS\system32\DRIVERS\kmxagent.sys [2007-05-18 13:30]
R1 KmxFile;KmxFile;C:\WINDOWS\system32\DRIVERS\KmxFile.sys [2007-05-18 13:30]
R2 KmxCF;KmxCF;C:\WINDOWS\system32\DRIVERS\KmxCF.sys [2007-10-18 10:24]
R2 KmxSbx;KmxSbx;C:\WINDOWS\system32\DRIVERS\KmxSbx.sys [2007-11-02 12:09]
R2 UmxAgent;HIPS Event Manager;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe" [2007-10-18 10:24]
R2 UmxCfg;HIPS Configuration Interpreter;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe" [2007-10-18 10:24]
R2 UmxPol;HIPS Policy Manager;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe" [2007-05-18 13:30]
R3 KmxCfg;KmxCfg;C:\WINDOWS\system32\DRIVERS\kmxcfg.sys [2007-09-13 15:15]
R3 LucentSoftModem;Lucent Technologies Soft Modem;C:\WINDOWS\system32\DRIVERS\LTSM.sys [2001-08-17 09:28]
R3 PPCtlPriv;PPCtlPriv;"C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe" [2008-01-31 17:24]
S1 KmxFw;KmxFw;C:\WINDOWS\system32\DRIVERS\kmxfw.sys [2007-10-18 14:21]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\setup.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-04-11 00:45:13 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-04-11 16:41:21 C:\WINDOWS\Tasks\CAAntiSpywareScan_Daily as RYAN at 12 41 PM.job"
- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\caantispyware.exe
.
**************************************************************************
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-04-13 14:32:04
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe
C:\WINDOWS\system32\WLTRYSVC.EXE
C:\WINDOWS\system32\BCMWLTRY.EXE
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\cappactiveprotection.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-04-13 14:38:27 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-13 18:38:13
Pre-Run: 21,534,228,480 bytes free
Post-Run: 22,272,856,064 bytes free
.
2008-01-09 08:03:11 --- E O F ---
Logfile of Trend Micro HijackThis v2.0.2Scan saved at 2:51:14 PM, on 13/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.32\QOELoader.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Pro Imaging Powertoys\Microsoft Color Control Panel Applet for Windows XP\WinColorReminder.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox 3 Beta 5\firefox.exe
C:\Highjackthis\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.daemon-search.com/startpageR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft....k/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft....k/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft....k/?LinkId=54896R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: CA Toolbar Helper - {FBF2401B-7447-4727-BE5D-C19B2075CA84} - C:\Program Files\CA\CA Internet Security Suite\CA Website Inspector\WebsiteInspector\Toolbar\CallingIDIE.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: CA Toolbar - {10134636-E7AF-4AC5-A1DC-C7C44BB97D81} - C:\Program Files\CA\CA Internet Security Suite\CA Website Inspector\WebsiteInspector\Toolbar\CallingIDIE.dll
O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [CaPPcl] C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAAntiSpyware.exe /scan /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.32\QOELoader.exe"
O4 - HKLM\..\Run: [cafw] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [capfasem] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
O4 - HKLM\..\Run: [capfupgrade] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WinColorReminder] C:\Program Files\Pro Imaging Powertoys\Microsoft Color Control Panel Applet for Windows XP\WinColorReminder.exe
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{5394F247-AF7B-419A-8815-CF89E72D21B3}: NameServer = 85.255.115.67,85.255.112.122
O17 - HKLM\System\CCS\Services\Tcpip\..\{8865BB84-D17D-43AE-8F79-7A09B315B9BF}: NameServer = 85.255.115.67,85.255.112.122
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.67 85.255.112.122
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.67 85.255.112.122
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.115.67 85.255.112.122
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: NameServer = 85.255.115.67 85.255.112.122
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.67 85.255.112.122
O20 - Winlogon Notify: khfDtTll - khfDtTll.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
--
End of file - 10592 bytes