ComboFix 08-05-20.5 - Compaq_Owner 2008-05-21 15:51:22.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.410 [GMT -4:00]
Running from: C:\Documents and Settings\Compaq_Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Compaq_Owner\Desktop\CFScript.txt
* Created a new restore point
* Resident AV is active
.
((((((((((((((((((((((((( Files Created from 2008-04-21 to 2008-05-21 )))))))))))))))))))))))))))))))
.
2008-05-21 14:14 . 2008-05-21 14:14 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-21 14:14 . 2008-05-21 14:14 <DIR> d-------- C:\Documents and Settings\Compaq_Owner\Application Data\Malwarebytes
2008-05-21 14:14 . 2008-05-21 14:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-21 14:14 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-21 14:14 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-20 03:17 . 2008-05-20 03:17 118 --a------ C:\WINDOWS\system32\MRT.INI
2008-05-14 19:21 . 2008-05-14 19:21 244 --ah----- C:\sqmnoopt15.sqm
2008-05-14 19:21 . 2008-05-14 19:21 244 --ah----- C:\sqmnoopt14.sqm
2008-05-14 19:21 . 2008-05-14 19:21 244 --ah----- C:\sqmnoopt13.sqm
2008-05-14 19:21 . 2008-05-14 19:21 244 --ah----- C:\sqmnoopt12.sqm
2008-05-14 19:21 . 2008-05-14 19:21 232 --ah----- C:\sqmdata15.sqm
2008-05-14 19:21 . 2008-05-14 19:21 232 --ah----- C:\sqmdata14.sqm
2008-05-14 19:21 . 2008-05-14 19:21 232 --ah----- C:\sqmdata13.sqm
2008-05-14 19:21 . 2008-05-14 19:21 232 --ah----- C:\sqmdata12.sqm
2008-05-14 19:20 . 2008-05-14 19:20 244 --ah----- C:\sqmnoopt11.sqm
2008-05-14 19:20 . 2008-05-14 19:20 244 --ah----- C:\sqmnoopt10.sqm
2008-05-14 19:20 . 2008-05-14 19:20 244 --ah----- C:\sqmnoopt09.sqm
2008-05-14 19:20 . 2008-05-14 19:20 232 --ah----- C:\sqmdata11.sqm
2008-05-14 19:20 . 2008-05-14 19:20 232 --ah----- C:\sqmdata10.sqm
2008-05-14 19:20 . 2008-05-14 19:20 232 --ah----- C:\sqmdata09.sqm
2008-05-14 19:19 . 2008-05-14 19:19 244 --ah----- C:\sqmnoopt08.sqm
2008-05-14 19:19 . 2008-05-14 19:19 244 --ah----- C:\sqmnoopt07.sqm
2008-05-14 19:19 . 2008-05-14 19:19 232 --ah----- C:\sqmdata08.sqm
2008-05-14 19:19 . 2008-05-14 19:19 232 --ah----- C:\sqmdata07.sqm
2008-05-07 00:17 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-05-07 00:17 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-05-06 23:37 . 2008-05-06 23:38 <DIR> d-------- C:\WINDOWS\ERUNT
2008-05-06 23:32 . 2008-05-06 23:32 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot
2008-05-06 23:18 . 2008-05-06 23:18 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-04 21:43 . 2008-05-04 21:43 <DIR> d-------- C:\Program Files\NoAdware5.0
2008-04-27 23:21 . 2008-04-27 23:21 <DIR> d-------- C:\Documents and Settings\Compaq_Owner\Application Data\dvdcss
2008-04-27 21:52 . 2008-04-27 22:14 96,645 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-04-27 21:52 . 2008-04-27 22:14 87,941 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-04-27 21:48 . 2008-04-27 21:48 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-04-27 21:48 . 2008-05-21 03:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-04-27 21:48 . 2008-05-21 16:01 5,755,936 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-04-27 21:48 . 2008-05-20 13:05 71,060 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-04-27 21:48 . 2008-05-21 16:00 42,528 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-04-27 21:48 . 2008-05-20 13:05 4,316 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-04-27 21:43 . 2008-04-27 21:43 <DIR> d-------- C:\KAV
2008-04-27 00:36 . 2008-04-27 00:36 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-04-21 16:21 . 2008-04-23 16:23 <DIR> d-------- C:\Program Files\Windows Defender
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-07 03:02 --------- d-----w C:\Program Files\Symantec
2008-05-07 03:01 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-04-28 01:26 --------- d-----w C:\Program Files\Norton AntiVirus
2008-04-28 01:26 --------- d-----w C:\Documents and Settings\Compaq_Owner\Application Data\Symantec
2008-04-28 01:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-04-09 22:10 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-03-29 08:49 --------- d-----w C:\Documents and Settings\Compaq_Owner\Application Data\Skype
2008-03-28 21:39 --------- d-----w C:\Documents and Settings\Compaq_Owner\Application Data\skypePM
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\dllcache\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
2008-03-01 22:36 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-02-29 08:55 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-02-29 08:55 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-02-22 10:00 13,824 ----a-w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-01-28 04:14 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2005-09-04 06:02 22 -csha-w C:\WINDOWS\SMINST\HPCD.sys
.
((((((((((((((((((((((((((((( snapshot@2008-05-20_13.14.28.54 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-20 17:07:02 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-21 07:49:32 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-01 19:41 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSPower"="Rundll32.exe" [2004-08-04 00:00 33280 C:\WINDOWS\system32\rundll32.exe]
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-25 18:34 245760]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 09:54 253952]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2003-05-15 19:41 163840]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-05-25 17:18 180269]
"USB Storage Toolbox"="C:\Program Files\USBToolbox\Res.EXE" [2002-01-15 10:23 118784]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 16:09 157592]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 04:10 49263]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2006-06-29 19:54 269104]
"VX6000"="C:\WINDOWS\vVX6000.exe" [2006-06-29 19:55 994096]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58 282624]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36 256576]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51 218376]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 19:50:52 53248]
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2005-09-06 13:19:45 118784]
SpySubtract.lnk - C:\Program Files\InterMute\SpySubtract\sslaunch.exe [2005-05-25 17:28:14 73728]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Compaq Connections\\6750491\\Program\\Compaq Connections.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\system32\\ccapp.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Skype\\Skype.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6346:TCP"= 6346:TCP:limewirepro
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 05:47]
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamSvc.exe" [2006-06-29 19:54]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-04 04:40]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 14:58]
R3 VX6000;Microsoft LifeCam VX-6000;C:\WINDOWS\system32\DRIVERS\VX6000Xp.sys [2006-06-29 19:56]
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-05-21 16:00:45
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-05-21 16:05:03
ComboFix-quarantined-files.txt 2008-05-21 20:04:50
ComboFix2.txt 2008-05-21 18:01:55
ComboFix3.txt 2008-05-20 17:21:43
Pre-Run: 30,228,041,728 bytes free
Post-Run: 30,217,891,840 bytes free
154 --- E O F --- 2008-05-20 07:17:49