Hi there.
Logs attached
Hugs
=====================
ComboFix 08-05-01.3 - Sorin 2008-05-03 19:16:18.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.628 [GMT 3:00]
Running from: C:\Documents and Settings\Sorin\Desktop\ComboFix.exe
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.
((((((((((((((((((((((((( Files Created from 2008-04-03 to 2008-05-03 )))))))))))))))))))))))))))))))
.
2008-05-02 23:15 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-05-02 23:13 . 2008-05-02 23:15 <DIR> d-------- C:\Program Files\Java
2008-05-02 23:13 . 2008-05-02 23:13 <DIR> d-------- C:\Program Files\Common Files\Java
2008-05-02 21:32 . 2008-05-02 21:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-05-01 10:38 . 2008-05-01 10:38 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-05-01 10:38 . 2008-05-01 10:38 <DIR> d-------- C:\WINDOWS\system32\en
2008-05-01 10:38 . 2008-05-01 10:38 <DIR> d-------- C:\WINDOWS\l2schemas
2008-05-01 10:38 . 2008-04-14 05:42 69,120 --------- C:\WINDOWS\system32\wlanapi.dll
2008-05-01 10:38 . 2008-04-14 05:42 53,248 --------- C:\WINDOWS\system32\tsgqec.dll
2008-05-01 10:38 . 2008-04-14 05:42 50,688 --------- C:\WINDOWS\system32\tspkg.dll
2008-05-01 10:31 . 2008-04-13 22:06 144,384 --------- C:\WINDOWS\system32\drivers\hdaudbus.sys
2008-05-01 10:31 . 2008-04-14 00:10 10,240 --------- C:\WINDOWS\system32\drivers\sffp_mmc.sys
2008-05-01 10:29 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\
006012_.tmp
2008-04-25 09:15 . 2008-05-01 10:09 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-04-25 09:15 . 2008-04-25 09:15 <DIR> d-------- C:\Documents and Settings\Sorin\Application Data\SUPERAntiSpyware.com
2008-04-25 09:15 . 2008-04-25 09:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-04-25 08:48 . 2008-04-25 08:48 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-25 08:48 . 2008-04-25 08:48 <DIR> d-------- C:\Documents and Settings\Sorin\Application Data\Malwarebytes
2008-04-25 08:48 . 2008-04-25 08:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-25 08:47 . 2008-04-25 08:47 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-04-22 07:10 . 2008-04-21 02:33 <DIR> d-------- C:\SDFix
2008-04-21 22:12 . 2008-04-21 22:12 <DIR> d-------- C:\Program Files\AVG
2008-04-21 22:12 . 2008-04-21 22:15 <DIR> d-------- C:\Documents and Settings\Sorin\Application Data\AVGTOOLBAR
2008-04-21 16:17 . 2008-04-21 16:17 <DIR> d-------- C:\Program Files\Panda Security
2008-04-21 15:36 . 2008-04-21 15:48 <DIR> d-------- C:\Log-uri
2008-04-21 15:17 . 2008-04-21 15:17 <DIR> d-------- C:\Deckard
2008-04-21 14:16 . 2008-04-21 14:16 <DIR> d-------- C:\WINDOWS\ERUNT
2008-04-21 12:44 . 2008-04-21 12:44 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-21 11:03 . 2008-04-21 11:03 <DIR> d-------- C:\Autoruns
2008-04-21 00:10 . 2008-04-21 00:18 446,706 --a------ C:\WINDOWS\system32\netsoft.exe
2008-04-20 23:18 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-04-20 23:18 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-04-20 23:18 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-04-20 23:18 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-04-20 18:42 . 2008-04-20 18:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sophos
2008-04-20 18:35 . 2008-04-20 18:35 <DIR> d-------- C:\savxpsa
2008-04-20 18:07 . 2008-04-20 21:32 <DIR> d-------- C:\Program Files\Sophos
2008-04-20 15:35 . 2008-04-20 15:35 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-04-20 08:59 . 2008-05-03 19:12 12,598 --a------ C:\WINDOWS\system32\wpa.dbl
2008-04-20 02:35 . 2008-04-20 02:35 <DIR> d-------- C:\WINDOWS\system32\backuped
2008-04-20 02:35 . 2008-04-21 13:02 <DIR> d-------- C:\Program Files\True Sword 4
2008-04-20 02:35 . 2008-04-20 02:35 <DIR> d-------- C:\Documents and Settings\Sorin\Application Data\True Sword
2008-04-20 02:15 . 2008-04-25 09:06 <DIR> d-------- C:\Temporar
2008-04-20 01:55 . 2008-04-25 09:14 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-20 00:36 . 2008-04-20 00:36 <DIR> d-------- C:\Documents and Settings\Sorin\Application Data\WinPatrol
2008-04-20 00:35 . 2008-04-20 00:35 <DIR> d-------- C:\Program Files\BillP Studios
2008-04-19 08:45 . 2008-04-19 08:45 <DIR> d-------- C:\Program Files\Zone Labs
2008-04-19 08:42 . 2007-12-13 13:28 24,592 --a------ C:\WINDOWS\system32\drivers\klim5.sys
2008-04-18 22:16 . 2008-04-18 22:16 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-04-18 22:16 . 2008-04-18 23:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-04-17 11:28 . 2008-04-17 11:28 <DIR> d-------- C:\Documents and Settings\Sorin\Application Data\F-Secure
2008-04-17 11:22 . 2008-04-17 11:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
2008-04-17 11:21 . 2008-04-17 11:57 <DIR> d-------- C:\Program Files\F-Secure Internet Security
2008-04-17 11:14 . 2008-04-17 11:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\fssg
2008-04-17 11:06 . 2008-03-07 06:34 1,126,072 --a------ C:\WINDOWS\system32\drivers\vsapint.sys
2008-04-17 11:06 . 2008-03-07 06:34 202,768 --a------ C:\WINDOWS\system32\drivers\tmxpflt.sys
2008-04-17 11:06 . 2008-03-07 06:34 35,856 --a------ C:\WINDOWS\system32\drivers\tmpreflt.sys
2008-04-16 23:02 . 2008-04-16 23:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro
2008-04-16 22:45 . 2008-04-19 09:05 <DIR> d-------- C:\Documents and Settings\Sorin\.housecall6.6
2008-04-05 14:25 . 2008-04-05 14:25 <DIR> d-------- C:\Program Files\Safari
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-03 16:02 --------- d-----w C:\Program Files\uTorrent
2008-05-03 05:42 1,476,608 ----a-w C:\WINDOWS\Internet Logs\xDB13.tmp
2008-05-03 05:25 2,990,592 ----a-w C:\WINDOWS\Internet Logs\xDB11.tmp
2008-05-03 05:24 1,865,728 ----a-w C:\WINDOWS\Internet Logs\xDB12.tmp
2008-05-01 11:48 1,820,160 ----a-w C:\WINDOWS\Internet Logs\xDB10.tmp
2008-04-22 15:35 3,024,896 ----a-w C:\WINDOWS\Internet Logs\xDBE.tmp
2008-04-22 15:35 1,750,016 ----a-w C:\WINDOWS\Internet Logs\xDBF.tmp
2008-04-22 03:25 2,920,960 ----a-w C:\WINDOWS\Internet Logs\xDBC.tmp
2008-04-22 03:25 1,745,408 ----a-w C:\WINDOWS\Internet Logs\xDBD.tmp
2008-04-21 12:33 133,632 ----a-w C:\WINDOWS\Internet Logs\xDBA.tmp
2008-04-21 12:33 1,720,832 ----a-w C:\WINDOWS\Internet Logs\xDBB.tmp
2008-04-21 12:26 2,505,216 ----a-w C:\WINDOWS\Internet Logs\xDB8.tmp
2008-04-21 12:26 1,737,728 ----a-w C:\WINDOWS\Internet Logs\xDB9.tmp
2008-04-21 07:22 1,202,938 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-04-20 20:08 3,537,408 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2008-04-20 20:08 1,659,392 ----a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2008-04-20 15:46 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-04-20 15:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-04-20 15:00 818,688 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-04-20 15:00 1,612,288 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2008-04-20 14:38 273,408 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-04-20 14:30 1,601,536 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2008-04-19 06:34 1,409,536 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-04-19 06:12 35,296 ----a-w C:\WINDOWS\system32\drivers\Dvd43.sys
2008-04-17 07:47 --------- d-----w C:\Program Files\ARCHPR
2008-04-16 20:16 --------- d-----w C:\Documents and Settings\Sorin\Application Data\Symantec
2008-04-15 09:23 --------- d-----w C:\Program Files\CNN Desktop Alerts
2008-04-15 06:16 --------- d-----w C:\Documents and Settings\Sorin\Application Data\Azureus
2008-04-14 02:55 1,804 ----a-w C:\WINDOWS\system32\dcache.bin
2008-04-14 02:46 329,728 ----a-w C:\WINDOWS\system32\netsetup.exe
2008-04-14 02:43 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll
2008-04-14 02:43 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll
2008-04-14 02:43 40,840 ----a-w C:\WINDOWS\system32\drivers\termdd.sys
2008-04-14 02:43 21,896 ----a-w C:\WINDOWS\system32\drivers\tdtcp.sys
2008-04-14 02:43 139,656 ----a-w C:\WINDOWS\system32\drivers\rdpwd.sys
2008-04-14 02:43 12,168 ----a-w C:\WINDOWS\system32\tsddd.dll
2008-04-14 02:43 12,040 ----a-w C:\WINDOWS\system32\drivers\tdpipe.sys
2008-04-14 02:41 98,304 ----a-w C:\WINDOWS\system32\actxprxy.dll
2008-04-14 02:40 53,279 ----a-w C:\WINDOWS\system32\odbcji32.dll
2008-04-14 02:40 4,126 ----a-w C:\WINDOWS\system32\msdxmlc.dll
2008-04-14 02:40 3,584 ----a-w C:\WINDOWS\system32\msafd.dll
2008-04-13 22:00 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys
2008-04-13 21:58 175,744 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys
2008-04-13 21:57 2,188,928 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 21:51 162,816 ----a-w C:\WINDOWS\system32\drivers\netbt.sys
2008-04-13 21:50 91,520 ----a-w C:\WINDOWS\system32\drivers\ndiswan.sys
2008-04-13 21:50 361,344 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-04-13 21:50 182,656 ----a-w C:\WINDOWS\system32\drivers\ndis.sys
2008-04-13 21:49 75,264 ----a-w C:\WINDOWS\system32\drivers\ipsec.sys
2008-04-13 21:49 51,328 ----a-w C:\WINDOWS\system32\drivers\rasl2tp.sys
2008-04-13 21:49 48,384 ----a-w C:\WINDOWS\system32\drivers\raspptp.sys
2008-04-13 21:49 146,048 ----a-w C:\WINDOWS\system32\drivers\portcls.sys
2008-04-13 21:49 138,112 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-04-13 21:48 52,480 ----a-w C:\WINDOWS\system32\drivers\i8042prt.sys
2008-04-13 21:47 83,072 ----a-w C:\WINDOWS\system32\drivers\wdmaud.sys
2008-04-13 21:47 456,576 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
2008-04-13 21:47 105,344 ----a-w C:\WINDOWS\system32\drivers\mup.sys
2008-04-13 21:46 49,536 ----a-w C:\WINDOWS\system32\drivers\classpnp.sys
2008-04-13 21:46 141,056 ----a-w C:\WINDOWS\system32\drivers\ks.sys
2008-04-13 21:45 64,512 ----a-w C:\WINDOWS\system32\drivers\serial.sys
2008-04-13 21:45 60,800 ----a-w C:\WINDOWS\system32\drivers\sysaudio.sys
2008-04-13 21:45 574,976 ----a-w C:\WINDOWS\system32\drivers\ntfs.sys
2008-04-13 21:45 334,848 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-04-13 21:44 63,744 ----a-w C:\WINDOWS\system32\drivers\cdfs.sys
2008-04-13 21:44 143,744 ----a-w C:\WINDOWS\system32\drivers\fastfat.sys
2008-04-13 21:30 30,080 ----a-w C:\WINDOWS\system32\drivers\modem.sys
2008-04-13 21:30 225,664 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-04-13 21:30 19,072 ----a-w C:\WINDOWS\system32\drivers\tdi.sys
2008-04-13 21:27 41,472 ----a-w C:\WINDOWS\system32\drivers\raspppoe.sys
2008-04-13 21:27 40,576 ----a-w C:\WINDOWS\system32\drivers\ndproxy.sys
2008-04-13 21:27 34,560 ----a-w C:\WINDOWS\system32\drivers\wanarp.sys
2008-04-13 21:27 20,864 ----a-w C:\WINDOWS\system32\drivers\ipinip.sys
2008-04-13 21:27 152,832 ----a-w C:\WINDOWS\system32\drivers\ipnat.sys
2008-04-13 21:27 14,336 ----a-w C:\WINDOWS\system32\drivers\asyncmac.sys
2008-04-13 21:27 10,112 ----a-w C:\WINDOWS\system32\drivers\ndistapi.sys
2008-04-13 21:26 88,320 ----a-w C:\WINDOWS\system32\drivers\nwlnkipx.sys
2008-04-13 21:26 69,120 ----a-w C:\WINDOWS\system32\drivers\psched.sys
2008-04-13 21:26 35,072 ----a-w C:\WINDOWS\system32\drivers\msgpc.sys
2008-04-13 21:26 34,688 ----a-w C:\WINDOWS\system32\drivers\netbios.sys
2008-04-13 21:26 30,592 ----a-w C:\WINDOWS\system32\drivers\rndismp.sys
2008-04-13 21:26 30,592 ------w C:\WINDOWS\system32\drivers\rndismpx.sys
2008-04-13 21:26 14,592 ----a-w C:\WINDOWS\system32\drivers\ndisuio.sys
2008-04-13 21:26 12,800 ----a-w C:\WINDOWS\system32\drivers\usb8023.sys
2008-04-13 21:26 12,800 ------w C:\WINDOWS\system32\drivers\usb8023x.sys
2008-04-13 21:26 12,288 ----a-w C:\WINDOWS\system32\drivers\tunmp.sys
2008-04-13 21:25 202,624 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-04-13 21:24 11,264 ----a-w C:\WINDOWS\system32\drivers\irenum.sys
2008-04-13 21:23 71,552 ----a-w C:\WINDOWS\system32\drivers\bridge.sys
2008-04-13 21:23 40,320 ----a-w C:\WINDOWS\system32\drivers\nmnt.sys
2008-04-13 21:23 36,608 ------w C:\WINDOWS\system32\drivers\ip6fw.sys
2008-04-13 21:23 264,832 ------w C:\WINDOWS\system32\drivers\http.sys
2008-04-13 21:21 61,824 ----a-w C:\WINDOWS\system32\drivers\nic1394.sys
2008-04-13 21:21 60,800 ----a-w C:\WINDOWS\system32\drivers\arp1394.sys
2008-04-13 21:21 59,904 ----a-w C:\WINDOWS\system32\drivers\atmarpc.sys
2008-04-13 21:21 55,808 ----a-w C:\WINDOWS\system32\drivers\atmlane.sys
2008-04-13 21:21 101,120 ------w C:\WINDOWS\system32\drivers\bthpan.sys
2008-04-13 21:15 60,160 ----a-w C:\WINDOWS\system32\drivers\drmk.sys
2008-04-13 21:14 81,664 ----a-w C:\WINDOWS\system32\drivers\videoprt.sys
2008-04-13 21:14 799,744 ----a-w C:\WINDOWS\system32\drivers\dmboot.sys
2008-04-13 21:14 20,992 ----a-w C:\WINDOWS\system32\drivers\vga.sys
.
((((((((((((((((((((((((((((( snapshot_2008-05-03_ 8.18.37.04 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-02 20:22:14 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-03 16:09:28 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2007-10-11 12:12:48 1,468,968 ----a-w C:\WINDOWS\system32\LegitCheckControl.dll
+ 2008-03-20 15:06:36 1,480,232 ----a-w C:\WINDOWS\system32\LegitCheckControl.dll
- 2008-05-01 06:42:14 8,900,532 ----a-w C:\WINDOWS\system32\ZoneLabs\spyware.dat
+ 2008-05-03 09:04:58 8,937,491 ----a-w C:\WINDOWS\system32\ZoneLabs\spyware.dat
+ 2008-05-03 16:10:07 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_a8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 05:42 15360]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-01 10:09 1481968]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-13 23:11 919016]
"WinPatrol"="C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [2008-01-27 08:38 316728]
"WinFast Schedule"="C:\Program Files\WinFast\WFTVFM\WFWIZ.exe" [2007-02-12 17:22 397312]
"SoundMan"="SOUNDMAN.EXE" [2006-06-21 06:42 577536 C:\WINDOWS\soundman.exe]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-05-02 08:19 950664]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 1 (0x1)
"NoBandCustomize"= 0 (0x0)
"MaxRecentDocs"= 15 (0xf)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"VIDC.MJPG"= Pvmjpg30.dll
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
"CNN Desktop Alerts"=""
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
"AdobeUpdater"=C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
"SMSystemAnalyzer"="C:\Program Files\iolo\System Mechanic Professional 7\SMSystemAnalyzer.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"LVCOMSX"=C:\WINDOWS\system32\LVCOMSX.EXE
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" -atboottime
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"nwiz"=nwiz.exe /install
"PWRISOVM.EXE"=C:\Program Files\PowerISO\PWRISOVM.EXE
"Device Detector"=DevDetect.exe -autorun
"LogitechVideoTray"=C:\Program Files\Logitech\Video\LogiTray.exe
"LogitechVideoRepair"=C:\Program Files\Logitech\Video\ISStart.exe
"PinnacleDriverCheck"=C:\WINDOWS\system32\\PSDrvCheck.exe
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
"MSConfig"=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"RaidTool"=C:\Program Files\VIA\RAID\raid_tool.exe
"NSLauncher"=C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
"DVD43"=C:\PROGRA~1\DVDREG~1\DVDRegionFree.exe /hidden
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"H:\\Azureus\\utorrent-1.8-alpha-8205.upx.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"11892:TCP"= 11892:TCP:BitComet 11892 TCP
"11892:UDP"= 11892:UDP:BitComet 11892 UDP
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R2 BT848;WinFast TV2000 XP WDM Video Capture;C:\WINDOWS\system32\drivers\wf2kvcap.sys [2007-03-18 00:04]
R2 tv2ktunr;WinFast TV2000 XP WDM TVTuner;C:\WINDOWS\system32\drivers\wf2ktunr.sys [2007-03-18 00:04]
R2 Tv2kXbar;WinFast TV2000 XP WDM Crossbar;C:\WINDOWS\system32\drivers\wf2kxbar.sys [2007-03-18 00:04]
R3 Dvd43;Dvd43;C:\WINDOWS\system32\DRIVERS\Dvd43.sys [2008-04-19 09:12]
R3 WFIOCTL;WFIOCTL;C:\Program Files\WinFast\WFTVFM\WFIOCTL.SYS [2005-01-06 17:55]
S3 genmcmnUSB;USB Scroll Mouse Driver;C:\WINDOWS\system32\DRIVERS\gflmouhid.sys [2004-04-19 16:01]
S3 SiSV;SiSV;C:\WINDOWS\system32\DRIVERS\SiSV.sys [2001-08-17 15:50]
S3 V90drv;v90drv;C:\WINDOWS\system32\DRIVERS\v90drv.sys [2001-11-29 16:10]
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-05-03 19:18:32
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-05-03 19:19:28
ComboFix-quarantined-files.txt 2008-05-03 16:19:12
ComboFix2.txt 2008-05-03 05:19:02
ComboFix3.txt 2008-04-21 11:09:28
Pre-Run: 2,426,826,752 bytes free
Post-Run: 2,413,412,352 bytes free
292 --- E O F --- 2008-04-09 12:17:05
=================================================
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:22:01 PM, on 5/3/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft....k/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft....k/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft....k/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft....k/?LinkId=69157R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: IE to GetRight Helper - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} -
https://support.micr...veX/MSDcode.cabO16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} -
http://pcpitstop.com...p/PCPitStop.CABO16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) -
http://www.trendsecu...vex/TmHcmsX.CABO16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) -
http://acs.pandasoft...s/as2stubie.cabO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -
http://www.bitdefend...can8/oscan8.cabO16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} -
http://security.syma...n/bin/cabsa.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://fpdownload2.m...ash/swflash.cabO16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} -
http://driveragent.c...driveragent.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{746EE235-7CA4-4F54-9135-E2945E243183}: NameServer = 194.102.255.2,194.102.255.3
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O24 - Desktop Component 0: (no name) - (no file)
--
End of file - 7398 bytes
=======================================