ComboFix 08-08-21.02 - Risnes 2008-08-23 15:06:14.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2875 [GMT 2:00]
Running from: C:\Documents and Settings\Risnes\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\emtb.exe
.
((((((((((((((((((((((((( Files Created from 2008-07-23 to 2008-08-23 )))))))))))))))))))))))))))))))
.
2008-08-22 16:32 . 2008-08-22 16:32 1,206 --a------ C:\WINDOWS\system32\tmp.reg
2008-08-22 16:05 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-08-22 16:05 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-08-22 15:38 . 2008-08-22 15:38 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-08-22 15:09 . 2008-08-21 10:13 86,016 --a------ C:\WINDOWS\tqwolser.exe
2008-08-21 18:56 . 2008-08-21 18:56 <DIR> d-------- C:\Program Files\Analog Devices
2008-08-21 18:56 . 2001-09-11 14:20 1,285,632 --------- C:\WINDOWS\system32\SMMedia.dll
2008-08-21 18:55 . 2008-08-21 18:55 19,344 --a------ C:\WINDOWS\Ascd_tmp.ini
2008-08-21 18:45 . 2008-08-21 18:45 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-08-21 18:45 . 2008-08-21 19:00 <DIR> d-------- C:\Documents and Settings\Risnes\Contacts
2008-08-21 18:42 . 2008-08-21 18:45 <DIR> d-------- C:\Program Files\Windows Live
2008-08-21 18:42 . 2008-08-21 18:44 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-08-21 18:42 . 2008-08-21 18:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-08-21 18:37 . 2008-08-21 18:37 0 --a------ C:\WINDOWS\nsreg.dat
2008-08-21 18:21 . 2008-08-21 18:31 96,976 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-08-21 18:21 . 2008-08-21 18:31 87,855 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-08-21 18:20 . 2008-08-21 18:20 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-08-21 18:20 . 2008-08-21 18:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-08-21 18:20 . 2008-08-22 16:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-21 18:20 . 2008-08-23 15:15 1,229,344 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-08-21 18:20 . 2008-08-23 15:15 25,120 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-08-21 18:20 . 2008-08-23 15:14 20,312 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-08-21 18:20 . 2008-08-23 15:14 4,304 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-08-21 18:17 . 2008-08-21 18:17 <DIR> d-------- C:\WINDOWS\OPTIONS
2008-08-21 18:17 . 2008-08-21 18:17 <DIR> d-------- C:\Program Files\Marvell
2008-08-21 18:17 . 2008-08-21 18:56 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2008-08-21 18:17 . 2008-08-21 18:17 <DIR> d-------- C:\Program Files\ASUS WiFi-AP Solo
2008-08-21 18:17 . 2006-06-16 09:30 176,128 --a------ C:\WINDOWS\system32\drivers\RTL8187.sys
2008-08-21 18:17 . 2008-08-21 18:17 21,035 --a------ C:\WINDOWS\system32\drivers\AegisP.sys
2008-08-21 18:17 . 2006-03-31 04:39 13,532 --a------ C:\WINDOWS\system32\drivers\SjyPkt.sys
2008-08-21 18:16 . 2006-10-11 05:33 10,288 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2008-08-21 18:16 . 2004-08-13 12:56 5,810 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys
2008-08-20 19:14 . 2008-08-20 19:14 <DIR> d-------- C:\Documents and Settings\Risnes\Application Data\vlc
2008-08-19 08:22 . 2008-08-19 08:22 <DIR> d-------- C:\WINDOWS\nview
2008-08-19 08:22 . 2008-08-21 18:17 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-08-19 08:22 . 2008-08-19 08:22 <DIR> d-------- C:\NVIDIA
2008-08-19 08:22 . 2008-05-16 11:48 446,464 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-08-19 08:22 . 2008-05-16 14:01 446,464 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-08-19 08:22 . 2008-08-23 15:15 186,097 --a------ C:\WINDOWS\system32\nvapps.xml
2008-08-19 08:22 . 2008-05-16 14:01 18,070 --a------ C:\WINDOWS\system32\nvdisp.nvu
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-21 16:31 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
2008-08-19 04:06 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-19 04:02 --------- d-----w C:\Program Files\Windows Media Connect 2
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360]
"RocketDock"="D:\RocketDock\RocketDock.exe" [2007-09-02 13:58 495616]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 15:34 868352]
"nwiz"="nwiz.exe" [2008-05-16 14:01 1630208 C:\WINDOWS\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:56 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
ASUS WiFi-AP Solo.lnk - C:\Program Files\ASUS WiFi-AP Solo\RtWLan.exe [2008-08-21 18:17:39 987136]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 14:58]
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\WINDOWS\system32\DRIVERS\RTL8187.sys [2006-06-16 09:30]
S3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2006-03-31 04:39]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Risnes\Application Data\Mozilla\Firefox\Profiles\fq4dtz95.default\
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-08-23 15:15:34
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\Documents and Settings\Risnes\Local Settings\Application Data\Microsoft\Messenger\
[email protected]\SharingMetadata\Working\database_CE2C_3FD0_2C3F_B277\tmp.edb 131072 bytes
scan completed successfully
hidden files: 1
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> D:\RocketDock\RocketDock.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\verclsid.exe
.
**************************************************************************
.
Completion time: 2008-08-23 15:16:25 - machine was rebooted [Risnes]
ComboFix-quarantined-files.txt 2008-08-23 13:16:21
Pre-Run: 63,713,320,960 bytes free
Post-Run: 63,714,942,976 bytes free
126
§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§§
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:18:00, on 23.08.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20696)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\ctfmon.exe
D:\RocketDock\RocketDock.exe
C:\Program Files\ASUS WiFi-AP Solo\RtWLan.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Risnes\My Documents\Mine mottatte filer\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft....k/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft....k/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft....k/?LinkId=54896O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RocketDock] "D:\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ASUS WiFi-AP Solo.lnk = ?
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 3436 bytes