Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Troj/Virtum-Gen


  • Please log in to reply

#1
The Sorcerers Apprentice

The Sorcerers Apprentice

    New Member

  • Member
  • Pip
  • 1 posts
Can anyone help please?

I have Sophos running on my Vista Ultimate PC and Gods knows how have picked up th Troj/Virtum-Gen virus/spyware. I am not a teckie as such but gleemed enough out or previous posings to run ComboFix which generated the text file below. Could someone give me the next steps please!!!!

omboFix 08-06-20.4 - Simon 2008-06-22 19:04:35.1 - NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1252.1.1033.18.2021 [GMT 1:00]
Running from: C:\Users\Simon\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-05-22 to 2008-06-22 )))))))))))))))))))))))))))))))
.

2008-06-22 14:13 . 2008-06-22 14:13 0 --ah----- C:\Windows\System32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-06-22 14:11 . 2008-06-22 14:14 <DIR> d-------- C:\Users\Simon\AppData\Roaming\PC Suite
2008-06-22 14:11 . 2008-06-22 14:13 <DIR> d-------- C:\Users\All Users\PC Suite
2008-06-22 14:11 . 2008-06-22 14:13 <DIR> d-------- C:\ProgramData\PC Suite
2008-06-22 14:10 . 2008-06-22 14:13 <DIR> d-------- C:\Users\Simon\AppData\Roaming\Nokia
2008-06-22 14:10 . 2008-06-22 14:10 <DIR> d-------- C:\Program Files\DIFX
2008-06-22 14:10 . 2008-06-22 14:10 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2008-06-22 14:10 . 2008-06-22 14:10 <DIR> d-------- C:\Program Files\Common Files\Nokia
2008-06-22 14:10 . 2007-09-17 15:53 21,632 --a------ C:\Windows\System32\drivers\pccsmcfd.sys
2008-06-22 14:07 . 2008-06-22 14:10 <DIR> d----c--- C:\Windows\System32\DRVSTORE
2008-06-22 14:07 . 2008-06-22 14:07 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-06-22 13:57 . 2008-06-22 13:57 <DIR> d-------- C:\Users\All Users\Installations
2008-06-22 13:57 . 2008-06-22 13:57 <DIR> d-------- C:\ProgramData\Installations
2008-06-22 13:57 . 2008-06-22 14:10 <DIR> d-------- C:\Program Files\Nokia
2008-06-22 13:42 . 2008-06-22 13:42 33,280 --a------ C:\Windows\System32\winhja32.rom
2008-06-22 13:34 . 2008-06-22 13:49 <DIR> d-------- C:\Users\Simon\AppData\Roaming\zweitgeist
2008-06-22 13:13 . 2008-06-22 13:13 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-06-22 13:13 . 2008-06-22 13:50 <DIR> d-------- C:\Program Files\Ahead
2008-06-22 13:13 . 2004-07-20 17:24 1,568,768 --------- C:\Windows\System32\ImagX7.dll
2008-06-22 13:13 . 2004-07-20 17:24 476,320 --------- C:\Windows\System32\ImagXpr7.dll
2008-06-22 13:13 . 2004-07-20 17:24 471,040 --------- C:\Windows\System32\ImagXRA7.dll
2008-06-22 13:13 . 2004-07-09 09:43 364,544 --------- C:\Windows\System32\TwnLib4.dll
2008-06-22 13:13 . 2004-07-20 17:24 262,144 --------- C:\Windows\System32\ImagXR7.dll
2008-06-22 13:13 . 2001-07-09 11:50 155,648 --a------ C:\Windows\System32\NeroCheck.exe
2008-06-22 13:13 . 2004-03-03 21:30 125,184 --------- C:\Windows\System32\drivers\imagesrv.sys
2008-06-22 13:13 . 2000-06-26 11:45 106,496 --a------ C:\Windows\System32\TwnLib20.dll
2008-06-22 13:13 . 2001-06-26 08:15 38,912 --------- C:\Windows\System32\picn20.dll
2008-06-22 13:13 . 2004-03-03 21:30 5,504 --------- C:\Windows\System32\drivers\imagedrv.sys
2008-06-16 16:40 . 2008-06-16 16:42 <DIR> d-------- C:\Users\Public\becka's things
2008-06-15 11:42 . 2008-06-20 18:01 <DIR> d-------- C:\Program Files\iLinc
2008-06-14 19:45 . 2008-04-23 06:11 1,244,672 --a------ C:\Windows\System32\mcmde.dll
2008-06-14 19:45 . 2008-04-23 05:27 428,032 --a------ C:\Windows\System32\EncDec.dll
2008-06-14 19:45 . 2008-04-23 06:12 292,352 --a------ C:\Windows\System32\psisdecd.dll
2008-06-14 19:45 . 2008-04-23 06:12 218,624 --a------ C:\Windows\System32\psisrndr.ax
2008-06-14 19:45 . 2008-04-23 06:12 80,896 --a------ C:\Windows\System32\MSNP.ax
2008-06-14 19:45 . 2008-04-23 06:11 68,608 --a------ C:\Windows\System32\Mpeg2Data.ax
2008-06-14 19:45 . 2008-04-23 06:11 57,856 --a------ C:\Windows\System32\MSDvbNP.ax
2008-05-28 07:48 . 2008-03-08 01:37 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-05-28 07:48 . 2008-03-08 05:30 1,686,528 --a------ C:\Windows\System32\gameux.dll
2008-05-23 22:40 . 2008-05-23 22:55 <DIR> d-------- C:\Users\Simon\AppData\Roaming\ZoomBrowser EX
2008-05-23 22:36 . 2008-05-23 22:53 <DIR> d-------- C:\Users\All Users\ZoomBrowser
2008-05-23 22:36 . 2008-05-23 22:53 <DIR> d-------- C:\ProgramData\ZoomBrowser
2008-05-23 22:34 . 2008-05-23 22:49 <DIR> d-------- C:\Program Files\Canon
2008-05-23 22:34 . 2000-02-18 18:45 2,700,288 --a------ C:\Windows\System32\opapi11.dll
2008-05-23 22:34 . 1997-01-22 21:26 565,760 --------- C:\Windows\System32\MSVCP50.DLL
2008-05-23 22:34 . 1998-01-23 12:22 304,128 --a------ C:\Windows\IsUninst.exe
2008-05-23 21:40 . 2008-05-23 22:35 <DIR> d-------- C:\Program Files\Common Files\Canon

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-11 20:18 --------- d-----w C:\Program Files\Windows Mail
2008-06-10 16:13 --------- d-----w C:\ProgramData\Microsoft Help
2008-05-23 21:39 --------- d-----w C:\Program Files\Google
2008-05-21 15:59 --------- d-----w C:\Users\Rebecca\AppData\Roaming\Apple Computer
2008-05-17 06:42 --------- d-----w C:\ProgramData\FLEXnet
2008-05-13 18:49 --------- d-----w C:\ProgramData\UDL
2008-05-13 18:48 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-13 18:48 --------- d-----w C:\Program Files\EPSON
2008-05-10 15:04 --------- d-----w C:\ProgramData\BVRP Software
2008-05-10 15:04 --------- d-----w C:\Program Files\Avanquest update
2008-05-10 14:20 --------- d-----w C:\ProgramData\Sony Ericsson
2008-05-10 14:20 --------- d-----w C:\Program Files\Sony Ericsson
2008-05-10 03:30 14,848 ----a-w C:\Windows\System32\wshrm.dll
2008-05-10 01:21 113,664 ----a-w C:\Windows\system32\drivers\rmcast.sys
2008-05-07 18:36 --------- d-----w C:\Users\Simon\AppData\Roaming\Transparent
2008-05-03 14:07 --------- d-----w C:\ProgramData\Transparent
2008-05-03 14:07 --------- d-----w C:\Program Files\Transparent
2008-05-03 13:56 --------- d-----w C:\Program Files\Teaching-you
2008-05-03 13:49 --------- d-----w C:\Program Files\Belkin
2008-04-29 05:46 --------- d-----w C:\Users\Simon\AppData\Roaming\Roxio
2008-04-29 05:41 --------- d-----w C:\ProgramData\Dell
2008-04-29 05:40 --------- d-----w C:\Program Files\Common Files\Adobe
2008-04-29 03:50 181,760 ----a-w C:\Windows\System32\fsquirt.exe
2008-04-29 01:42 29,184 ----a-w C:\Windows\system32\drivers\BTHUSB.SYS
2008-04-29 01:42 220,160 ----a-w C:\Windows\system32\drivers\bthport.sys
2008-04-29 01:42 19,456 ----a-w C:\Windows\system32\drivers\bthenum.sys
2008-04-28 18:23 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-04-28 17:34 --------- d-----w C:\Program Files\MSBuild
2008-04-28 17:34 --------- d-----w C:\Program Files\Microsoft Works
2008-04-28 17:33 --------- d-----w C:\Program Files\Microsoft.NET
2008-04-28 17:31 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
2008-04-28 07:02 --------- d-----w C:\Users\Simon\AppData\Roaming\InstallShield
2008-04-27 18:10 --------- d-----w C:\Users\Jean\AppData\Roaming\Logitech
2008-04-27 15:30 --------- d-----w C:\Users\Simon\AppData\Roaming\Apple Computer
2008-04-27 13:13 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-04-27 13:13 --------- d-----w C:\Program Files\Windows Live
2008-04-27 13:06 --------- d-----w C:\ProgramData\WLInstaller
2008-04-27 12:39 --------- d-----w C:\ProgramData\Apple Computer
2008-04-27 12:39 --------- d-----w C:\Program Files\QuickTime
2008-04-27 12:39 --------- d-----w C:\Program Files\iTunes
2008-04-27 12:39 --------- d-----w C:\Program Files\iPod
2008-04-27 12:39 --------- d-----w C:\Program Files\Bonjour
2008-04-27 12:38 --------- d-----w C:\ProgramData\Apple
2008-04-27 12:38 --------- d-----w C:\Program Files\Common Files\Apple
2008-04-27 12:38 --------- d-----w C:\Program Files\Apple Software Update
2008-04-26 17:27 41,984 ----a-w C:\Windows\system32\drivers\monitor.sys
2008-04-26 17:27 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys
2008-04-26 17:26 296,448 ----a-w C:\Windows\System32\gdi32.dll
2008-04-26 17:26 2,027,008 ----a-w C:\Windows\System32\win32k.sys
2008-04-26 17:25 83,968 ----a-w C:\Windows\System32\dnsrslvr.dll
2008-04-26 17:25 24,576 ----a-w C:\Windows\System32\dnscacheugc.exe
2008-04-26 15:19 --------- d-----w C:\ProgramData\Sophos
2008-04-26 15:19 --------- d-----w C:\Program Files\Sophos
2008-04-26 15:19 --------- d-----w C:\Program Files\Common Files\Cisco Systems
2008-04-26 15:14 81,216 ----a-w C:\Windows\system32\drivers\savonaccess.sys
2008-04-26 15:13 17,920 ----a-w C:\Windows\System32\sophosboottasks.exe
2008-04-26 08:28 --------- d-----w C:\Users\Rebecca\AppData\Roaming\Logitech
2008-04-26 07:41 1,327,616 ----a-w C:\Windows\System32\quartz.dll
2008-04-25 18:42 --------- d-----w C:\ProgramData\McAfee
2008-04-25 18:36 --------- d-----w C:\Program Files\MSXML 4.0
2008-04-25 18:33 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-04-25 18:32 --------- d-----w C:\Users\Simon\AppData\Roaming\Logitech
2008-04-25 18:29 80,896 ----a-w C:\Windows\System32\wudriver.dll
2008-04-25 18:29 549,720 ----a-w C:\Windows\System32\wuapi.dll
2008-04-25 18:29 53,080 ----a-w C:\Windows\System32\wuauclt.exe
2008-04-25 18:29 43,352 ----a-w C:\Windows\System32\wups2.dll
2008-04-25 18:29 33,624 ----a-w C:\Windows\System32\wups.dll
2008-04-25 18:29 1,712,984 ----a-w C:\Windows\System32\wuaueng.dll
2008-04-25 18:29 1,524,224 ----a-w C:\Windows\System32\wucltux.dll
2008-04-25 18:28 31,232 ----a-w C:\Windows\System32\wuapp.exe
2008-04-25 18:28 163,000 ----a-w C:\Windows\System32\wuwebv.dll
2008-04-25 18:27 --------- d-sh--w C:\ProgramData\Templates
2008-04-25 18:27 --------- d-sh--w C:\ProgramData\Start Menu
2008-04-25 18:27 --------- d-sh--w C:\ProgramData\Favorites
2008-04-25 18:27 --------- d-sh--w C:\ProgramData\Documents
2008-04-25 18:27 --------- d-sh--w C:\ProgramData\Desktop
2008-04-25 18:27 --------- d-sh--w C:\ProgramData\Application Data
2008-04-25 04:23 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-04-25 04:23 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-04-25 04:23 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-04-25 04:22 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-04-23 03:49 87,040 ----a-w C:\Windows\System32\msoert2.dll
2008-04-23 03:49 39,424 ----a-w C:\Windows\System32\ACCTRES.dll
2008-04-23 03:49 229,888 ----a-w C:\Windows\System32\msshsq.dll
2008-04-23 03:49 205,824 ----a-w C:\Windows\System32\msoeacct.dll
2008-04-23 03:49 2,048 ----a-w C:\Windows\System32\msxml6r.dll
2008-04-23 03:49 1,335,296 ----a-w C:\Windows\System32\msxml6.dll
2008-04-23 03:48 750,080 ----a-w C:\Windows\System32\qmgr.dll
2008-04-23 03:46 974,336 ----a-w C:\Windows\System32\crypt32.dll
2008-04-23 03:46 8,704 ----a-w C:\Windows\System32\hcrstco.dll
2008-04-23 03:46 8,704 ----a-w C:\Windows\System32\hccoin.dll
2008-04-23 03:46 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL
2008-04-23 03:46 73,216 ----a-w C:\Windows\system32\drivers\usbccgp.sys
2008-04-23 03:46 7,680 ----a-w C:\Windows\System32\spwmp.dll
2008-04-23 03:46 5,888 ----a-w C:\Windows\system32\drivers\usbd.sys
2008-04-23 03:46 4,096 ----a-w C:\Windows\System32\dxmasf.dll
2008-04-23 03:46 38,400 ----a-w C:\Windows\system32\drivers\usbehci.sys
2008-04-23 03:46 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
2008-04-23 03:46 23,040 ----a-w C:\Windows\system32\drivers\usbuhci.sys
2008-04-23 03:46 224,768 ----a-w C:\Windows\system32\drivers\usbport.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 13:34 125440]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2008-03-11 12:44 202544]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 16:19 356352]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-22 21:19 68856]
"MSSMSGS"="winhja32.rom,SOeRun" []
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41 1232896]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 12:53 1079808]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 13:33 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ECenter"="C:\Dell\E-Center\EULALauncher.exe" [2008-02-29 05:18 17920]
"Bluetooth HCI Monitor"="HCIMNTR.DLL" [2006-12-08 00:50 9728 C:\Windows\System32\HCIMNTR.DLL]
"SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-12 09:40 405504]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-04-25 05:55 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-04-25 05:54 8429568]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-04-25 05:54 81920]
"SunJavaUpdateSched"="c:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2008-04-22 21:08 77824]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 15:44 178712]
"Logitech Hardware Abstraction Layer"="C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE" [2007-10-09 08:09 100888]
"Logitech BT Wizard"="LBTWiz.exe" []
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-04-22 21:19 29744]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 12:44 16384]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe" [2007-12-14 14:25 244208]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-10-09 08:09 100888 C:\Windows\KHALMNPR.Exe]
"WPCUMI"="C:\Windows\system32\WpcUmi.exe" [2006-11-02 13:33 176128]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2008-03-11 12:44 202544]
"NeroFilterCheck"="C:\Windows\system32\NeroCheck.exe" [2001-07-09 11:50 155648]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
AutoUpdate Monitor.lnk - C:\Program Files\Sophos\AutoUpdate\ALMon.exe [2008-04-26 16:18:41 245760]
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-02-13 11:43:38 715568]
SetPoint.lnk - C:\Program Files\SetPoint\SetPoint.exe [2008-04-22 21:12:22 679936]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"LogonHoursAction"= 2 (0x2)
"DontDisplayLogonHoursWarnings"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService]
@="service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SophosAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{A9118919-1E1E-4FEB-8229-3195789F54D1}"= Disabled:UDP:C:\Program Files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"{A3319CAB-BA8B-4A90-8976-74D76CCB7974}"= Disabled:TCP:C:\Program Files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"{5F1B18D9-4D2A-4644-9724-A005649D0A93}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{07A68E40-3AC3-41E8-96E6-99D1CA9F3A8E}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{6877C0A5-C9DE-4A3F-AFEF-D6DC46559AAC}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{B6A380C3-13C5-4909-A98A-87C24F8AACB4}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{C734E60E-7DC8-476C-8C83-22EF952A1DDE}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{FDB5F0AC-9422-498C-A109-CAAD1D8523C8}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{CE1E148A-FD07-47BA-8063-59997CCDF421}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{6016752B-E051-47E4-B6FD-6C3A42B0D479}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{EA767D8B-6BA8-4D64-BCB7-BA78E9C734A3}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{34BF7DB9-B59A-4517-872B-DEC0E55E4468}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{DFD0F0F7-8F64-4C60-8C5C-EC8B1A8AF7C7}C:\\program files\\adobe\\photoshop elements 6.0\\adobephotoshopelementsmediaserver.exe"= UDP:C:\program files\adobe\photoshop elements 6.0\adobephotoshopelementsmediaserver.exe:AdobePhotoshopElementsMediaServer
"UDP Query User{00A8015B-E9FD-4A6D-AF90-9060B73DF31B}C:\\program files\\adobe\\photoshop elements 6.0\\adobephotoshopelementsmediaserver.exe"= TCP:C:\program files\adobe\photoshop elements 6.0\adobephotoshopelementsmediaserver.exe:AdobePhotoshopElementsMediaServer

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R1 SAVOnAccess;SAVOnAccess;C:\Windows\system32\DRIVERS\savonaccess.sys [2008-04-26 16:14]
R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-09-11 00:45]
R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2008-03-11 12:44]
R3 btwaudio;Bluetooth Audio Device Service;C:\Windows\system32\drivers\btwaudio.sys [2007-04-02 05:42]
R3 btwavdt;Bluetooth AVDT Service;C:\Windows\system32\drivers\btwavdt.sys [2007-04-02 05:42]
R3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-04-02 05:42]
R3 HCW85BDA;Hauppauge WinTV 885 Video Capture;C:\Windows\system32\drivers\HCW85BDA.sys [2007-11-20 08:20]
R3 LazerUsb;Lumanate Lazer USB;C:\Windows\system32\DRIVERS\LazerUsb.sys [2007-08-29 10:33]
S2 RoxLiveShare10;LiveShare P2P Server 10;"C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe" [2007-12-14 14:25]
S2 RoxWatch10;Roxio Hard Drive Watcher 10;"C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe" [2007-12-14 14:25]
S2 SessionLauncher;SessionLauncher;C:\Users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe []
S3 GoogleDesktopManager-010708-104812;Google Desktop Manager 5.7.801.7324;"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-04-22 21:19]
S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 08:36]
S3 RoxMediaDB10;RoxMediaDB10;"C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe" [2007-12-14 14:25]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2f34c5a0-2c37-11dd-b987-001cdf591c1f}]
\shell\AutoRun\command - K:\Autorun.exe /run
\shell\Shell00\Command - K:\Autorun.exe /run
\shell\Shell01\Command - K:\Autorun.exe /action
\shell\Shell02\Command - K:\Autorun.exe /uninstall

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-22 19:07:55
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C:\Windows\TEMP\TMP00000077CA6811AA73076696 524288 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************
.
Completion time: 2008-06-22 19:08:59
ComboFix-quarantined-files.txt 2008-06-22 18:08:54

Pre-Run: 800,550,686,720 bytes free
Post-Run: 801,110,978,560 bytes free

265 --- E O F --- 2008-06-20 14:09:18
  • 0

Advertisements







Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP