ComboFix 09-02-19.01 - Administrator 2009-02-21 22:53:07.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2559.2037 [GMT 0:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\ntdetect.PIF
c:\windows\system32\ctfmon.exe.tmp
c:\windows\system32\d3d8caps.dat
c:\windows\system32\twain32
c:\windows\system32\twain32\local.ds
c:\windows\system32\twain32\user.ds
----- BITS: Possible infected sites -----
hxxp://speedytorrents.net
.
((((((((((((((((((((((((( Files Created from 2009-01-21 to 2009-02-21 )))))))))))))))))))))))))))))))
.
2009-02-21 21:12 . 2009-02-21 21:12 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-21 21:12 . 2009-02-21 21:12 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-21 21:12 . 2009-02-21 21:12 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-02-21 21:12 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-21 21:12 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-21 20:53 . 2009-02-21 20:53 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll
2009-02-21 20:52 . 2009-02-21 20:52 <DIR> d-------- c:\windows\ERUNT
2009-02-21 20:49 . 2009-02-21 21:02 <DIR> d-------- C:\SDFix
2009-02-21 20:20 . 2009-02-21 20:21 <DIR> d-------- c:\windows\system32\Adobe
2009-02-21 19:59 . 2009-02-21 19:59 <DIR> d--h----- c:\windows\PIF
2009-02-21 17:53 . 2009-02-21 17:53 <DIR> d-------- c:\program files\Lavalys
2009-02-21 17:11 . 2009-02-21 17:11 <DIR> d-------- c:\program files\RFA
2009-02-21 17:11 . 2009-02-21 17:11 <DIR> d-------- c:\documents and settings\All Users\Application Data\RFA_Backups
2009-02-21 16:19 . 2009-02-21 16:23 163,712 --a------ c:\windows\system32\drivers\vidstub.sys
2009-02-20 21:22 . 2009-02-20 21:22 0 --a------ c:\windows\nsreg.dat
2009-02-19 17:44 . 2009-02-19 17:44 <DIR> d-------- c:\program files\Lavasoft RegHance
2009-02-19 17:35 . 2009-02-19 17:35 <DIR> d-------- c:\program files\Lavasoft
2009-02-19 17:35 . 2009-02-19 17:35 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Lavasoft
2009-02-19 17:34 . 2009-02-19 17:34 <DIR> d-------- c:\program files\Bit Che
2009-02-19 17:34 . 2009-02-19 17:34 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Convivea
2009-02-19 17:05 . 2009-02-19 17:05 <DIR> d-------- c:\program files\Common Files\Download Manager
2009-02-19 17:05 . 2009-02-19 17:05 1,152 --a------ c:\windows\system32\windrv.sys
2009-02-19 16:27 . 2009-02-19 16:27 <DIR> d-------- c:\documents and settings\All Users\Application Data\MSN6
2009-02-19 16:27 . 2009-02-19 16:28 <DIR> d-------- c:\documents and settings\Administrator\Application Data\MSN6
2009-02-19 16:03 . 2009-02-19 16:04 <DIR> d-------- c:\program files\SUPERAntiSpyware
2009-02-19 16:03 . 2009-02-19 16:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-02-19 16:03 . 2009-02-19 16:03 <DIR> d-------- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2009-02-19 14:15 . 2009-02-19 15:30 <DIR> d--h----- c:\windows\system32\GroupPolicy
2009-02-19 13:55 . 2009-02-19 13:55 <DIR> d-------- c:\program files\Trend Micro
2009-02-19 13:44 . 2009-02-19 13:44 <DIR> d-------- c:\documents and settings\Administrator\.housecall6.6
2009-02-19 13:43 . 2009-02-19 13:43 <DIR> d-------- c:\windows\Sun
2009-02-19 08:59 . 2009-02-19 08:59 0 --a------ c:\windows\vpc32.INI
2009-02-19 02:21 . 2009-02-19 02:21 <DIR> d-------- c:\program files\CCleaner
2009-02-19 00:56 . 2009-02-19 00:56 1,033,728 --a------ c:\windows\explorer.exe
2009-02-19 00:48 . 2009-02-21 16:19 <DIR> d-------- c:\program files\Stardock
2009-02-19 00:48 . 2009-02-19 00:48 <DIR> d-------- c:\program files\Common Files\Stardock
2009-02-19 00:37 . 2009-02-19 00:37 <DIR> d-------- c:\program files\uTorrent
2009-02-19 00:36 . 2009-02-21 18:16 <DIR> d-------- c:\documents and settings\Administrator\Application Data\uTorrent
2009-02-19 00:36 . 2004-03-09 00:00 1,081,616 --a------ c:\windows\system32\mscomctl.OCX
2009-02-19 00:36 . 2004-03-09 00:00 152,848 --a------ c:\windows\system32\comdlg32.OCX
2009-02-19 00:36 . 2004-03-09 00:00 124,688 --a------ c:\windows\system32\mswinsck.ocx
2009-02-19 00:15 . 2009-02-19 00:15 <DIR> d-------- c:\program files\Google
2009-02-18 23:45 . 2008-04-14 00:12 218,624 --a------ c:\windows\system32\uxtheme.uxtender
2009-02-18 23:39 . 2009-02-21 22:49 <DIR> d-------- c:\program files\Symantec AntiVirus
2009-02-18 23:39 . 2009-02-18 23:39 <DIR> d-------- c:\program files\Symantec
2009-02-18 23:39 . 2009-02-18 23:40 <DIR> d-------- c:\program files\Common Files\Symantec Shared
2009-02-18 23:39 . 2009-02-18 23:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\Symantec
2009-02-18 23:39 . 2009-02-18 23:39 110,952 --a------ c:\windows\system32\drivers\SYMEVENT.SYS
2009-02-18 23:39 . 2009-02-18 23:39 48,768 --a------ c:\windows\system32\S32EVNT1.DLL
2009-02-18 23:39 . 2009-02-18 23:39 8,014 --a------ c:\windows\system32\drivers\SYMEVENT.CAT
2009-02-18 23:39 . 2009-02-18 23:39 805 --a------ c:\windows\system32\drivers\SYMEVENT.INF
2009-02-18 23:33 . 2009-02-18 23:33 <DIR> d-------- c:\program files\PowerISO
2009-02-18 23:31 . 2008-12-20 23:15 6,066,688 -----c--- c:\windows\system32\dllcache\ieframe.dll
2009-02-18 23:31 . 2007-04-17 09:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat
2009-02-18 23:31 . 2007-03-08 05:10 991,232 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui
2009-02-18 23:31 . 2008-12-20 23:15 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll
2009-02-18 23:31 . 2008-12-20 23:15 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll
2009-02-18 23:31 . 2008-12-20 23:15 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll
2009-02-18 23:31 . 2008-12-20 23:15 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll
2009-02-18 23:31 . 2008-12-20 23:15 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll
2009-02-18 23:31 . 2009-02-19 04:50 13,824 --a--c--- c:\windows\system32\dllcache\ieudinit.exe
2009-02-18 23:25 . 2004-08-14 02:56 5,810 --a------ c:\windows\system32\drivers\ASACPI.sys
2009-02-18 23:22 . 2009-02-18 23:22 <DIR> d-------- c:\program files\Windows Media Connect 2
2009-02-18 23:22 . 2008-04-14 00:12 221,184 --a------ c:\windows\system32\wmpns.dll
2009-02-18 23:21 . 2009-02-19 02:25 <DIR> d-------- c:\windows\system32\LogFiles
2009-02-18 23:21 . 2009-02-18 23:21 <DIR> d-------- c:\windows\system32\drivers\UMDF
2009-02-18 23:19 . 2008-12-11 10:57 333,952 -----c--- c:\windows\system32\dllcache\srv.sys
2009-02-18 23:15 . 2008-10-24 11:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2009-02-18 23:14 . 2008-08-14 10:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2009-02-18 23:14 . 2008-08-14 10:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-02-18 23:14 . 2008-08-14 09:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-02-18 23:14 . 2008-08-14 09:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2009-02-18 23:14 . 2008-09-15 12:12 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys
2009-02-18 23:14 . 2008-09-04 17:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2009-02-18 23:14 . 2008-10-15 16:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2009-02-18 23:13 . 2008-05-01 14:33 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll
2009-02-18 23:12 . 2008-04-11 19:04 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
2009-02-18 23:12 . 2008-06-13 11:05 272,128 -----c--- c:\windows\system32\dllcache\bthport.sys
2009-02-18 23:12 . 2008-05-08 14:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys
2009-02-18 22:58 . 2009-02-18 22:58 <DIR> d-------- c:\program files\Java
2009-02-18 22:58 . 2009-02-18 22:58 <DIR> d-------- c:\program files\Common Files\Java
2009-02-18 22:58 . 2004-02-22 23:44 61,555 --a------ c:\windows\system32\jpicpl32.cpl
2009-02-18 22:57 . 2009-02-18 22:57 <DIR> d-------- c:\program files\Realtek Sound Manager
2009-02-18 22:57 . 2009-02-18 22:57 <DIR> d-------- c:\program files\AvRack
2009-02-18 22:57 . 2001-07-06 00:19 164 --a------ c:\windows\avrack.ini
2009-02-18 22:56 . 2009-02-18 22:57 <DIR> d-------- c:\program files\Realtek AC97
2009-02-18 22:56 . 2005-06-21 10:09 18,751,488 --a------ c:\windows\system32\ALSNDMGR.CPL
2009-02-18 22:56 . 2009-02-19 05:46 9,412,096 --a------ c:\windows\system32\RTLCPL.EXE
2009-02-18 22:56 . 2005-06-20 22:08 2,324,480 --a------ c:\windows\system32\drivers\ALCXWDM.SYS
2009-02-18 22:56 . 2009-02-19 03:04 294,912 --a------ c:\windows\alcupd.exe
2009-02-18 22:56 . 2009-02-19 03:04 200,704 --a------ c:\windows\alcrmv.exe
2009-02-18 22:56 . 2004-09-07 14:23 156,672 --a------ c:\windows\system32\RTLCPAPI.dll
2009-02-18 22:56 . 2002-02-05 13:54 141,016 --a------ c:\windows\system32\ALSNDMGR.WAV
2009-02-18 22:56 . 2009-02-19 04:37 77,824 --a------ c:\windows\SOUNDMAN.EXE
2009-02-18 22:56 . 2009-02-19 04:39 44,384 --a------ c:\windows\system32\ChCfg.exe
2009-02-18 22:53 . 2009-02-19 05:22 446,464 --a------ c:\windows\system32\nvunrm.exe
2009-02-18 22:53 . 2008-07-29 13:30 6,045 --a------ c:\windows\system32\nvnrm.nvu
2009-02-18 22:53 . 2008-07-08 01:45 4,984 --a------ c:\windows\system32\drivers\nvphy.bin
2009-02-18 22:46 . 2005-12-01 11:01 524,288 --a------ c:\windows\A8NSD016.BIN
2009-02-18 22:45 . 2009-02-18 22:46 453,395 --a------ c:\windows\A8NSD016.zip
2009-02-18 22:40 . 2009-02-19 09:52 <DIR> d--h----- c:\program files\InstallShield Installation Information
2009-02-18 22:32 . 2008-05-03 05:46 182,347 --a------ c:\windows\system32\nvapps.nvb
2009-02-18 17:48 . 2009-02-18 22:51 <DIR> d-------- c:\windows\nview
2009-02-18 17:48 . 2009-02-18 22:49 <DIR> d-------- c:\windows\nvidia icons
2009-02-18 17:48 . 2009-02-19 05:21 442,368 --a------ c:\windows\system32\nvudisp.exe
2009-02-18 17:48 . 2009-02-21 21:18 177,348 --a------ c:\windows\system32\nvapps.xml
2009-02-18 17:48 . 2008-05-03 05:46 18,070 --a------ c:\windows\system32\nvdisp.nvu
2009-02-18 17:47 . 2009-02-19 09:52 <DIR> d-------- c:\program files\Common Files\InstallShield
2009-02-18 17:45 . 2008-07-10 04:07 7,143 --a------ c:\windows\system32\nvide.nvu
2009-02-18 17:44 . 2009-02-18 17:47 <DIR> d-------- C:\NVIDIA
2009-02-18 17:44 . 2008-08-27 13:58 453,152 --a------ c:\windows\system32\NVUNINST.EXE
2009-02-18 17:33 . 2009-02-18 17:33 664 --a------ c:\windows\system32\d3d9caps.dat
2009-02-18 17:21 . 2009-02-18 17:21 <DIR> d-------- c:\windows\system32\scripting
2009-02-18 17:21 . 2009-02-18 17:21 <DIR> d-------- c:\windows\system32\en
2009-02-18 17:21 . 2009-02-18 17:21 <DIR> d-------- c:\windows\l2schemas
2009-02-18 17:12 . 2006-10-18 21:47 542,720 -----c--- c:\windows\system32\dllcache\blackbox.dll
2009-02-18 16:39 . 2009-02-18 16:39 <DIR> d-------- c:\windows\provisioning
2009-02-18 16:39 . 2009-02-18 17:21 <DIR> d-------- c:\windows\peernet
2009-02-18 16:39 . 2009-02-18 17:26 316,640 --a------ c:\windows\WMSysPr9.prx
2009-02-18 16:38 . 2009-02-18 16:38 <DIR> d-------- c:\windows\ServicePackFiles
2009-02-18 16:36 . 2009-02-18 17:16 <DIR> d-------- c:\windows\EHome
2009-02-18 16:34 . 2002-04-15 21:11 67,866 --------- c:\windows\system32\drivers\netwlan5.img
2009-02-18 16:34 . 2009-02-19 11:30 11,264 --a------ c:\windows\system32\spnpinst.exe
2009-02-18 16:34 . 2004-08-02 14:20 7,208 --------- c:\windows\system32\secupd.sig
2009-02-18 16:34 . 2004-08-02 14:20 4,569 --------- c:\windows\system32\secupd.dat
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-19 16:03 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-02-19 13:11 64,000 ----a-w c:\windows\system32\cleanmgr.exe
2009-02-19 12:34 10,752 ----a-w c:\windows\hh.exe
2009-02-19 12:21 99,840 ----a-w c:\windows\PCHealth\HelpCtr\Binaries\helphost.exe
2009-02-19 12:21 69,120 ----a-w c:\windows\notepad.exe
2009-02-19 12:20 744,448 ----a-w c:\windows\PCHealth\HelpCtr\Binaries\helpsvc.exe
2009-02-19 12:20 35,328 ----a-w c:\windows\PCHealth\HelpCtr\Binaries\notiflag.exe
2009-02-19 12:20 18,432 ----a-w c:\windows\PCHealth\HelpCtr\Binaries\hscupd.exe
2009-02-19 12:20 150,528 ----a-w c:\windows\PCHealth\UploadLB\Binaries\uploadm.exe
2009-02-19 12:19 146,432 ----a-w c:\windows\regedit.exe
2009-02-19 12:19 14,336 ----a-w c:\windows\system32\ssstars.scr
2009-02-19 12:18 9,216 ----a-w c:\windows\system32\subst.exe
2009-02-19 12:18 679,936 ----a-w c:\windows\system32\sstext3d.scr
2009-02-19 12:18 51,200 ----a-w c:\windows\system32\syncapp.exe
2009-02-19 12:18 14,848 ----a-w c:\windows\system32\stimon.exe
2009-02-19 12:17 71,680 ----a-w c:\windows\system32\systeminfo.exe
2009-02-19 12:17 36,864 ----a-w c:\windows\system32\syskey.exe
2009-02-19 12:17 106,496 ----a-w c:\windows\system32\sysocmgr.exe
2009-02-19 12:16 77,824 ----a-w c:\windows\system32\tasklist.exe
2009-02-19 12:16 76,288 ----a-w c:\windows\system32\taskkill.exe
2009-02-19 12:16 3,072 ----a-w c:\windows\system32\systray.exe
2009-02-19 12:16 12,288 ----a-w c:\windows\system32\tcmsetup.exe
2009-02-19 12:15 75,776 ----a-w c:\windows\system32\telnet.exe
2009-02-19 12:15 19,456 ----a-w c:\windows\system32\tcpsvcs.exe
2009-02-19 12:15 16,896 ----a-w c:\windows\system32\tftp.exe
2009-02-19 12:14 78,336 ----a-w c:\windows\system32\tlntsess.exe
2009-02-19 12:14 73,216 ----a-w c:\windows\system32\tlntsvr.exe
2009-02-19 12:14 61,440 ----a-w c:\windows\system32\tlntadmn.exe
2009-02-19 12:13 347,136 ----a-w c:\windows\system32\tourstart.exe
2009-02-19 12:13 31,744 ----a-w c:\windows\system32\tracert6.exe
2009-02-19 12:13 259,584 ----a-w c:\windows\system32\tracerpt.exe
2009-02-19 12:13 12,288 ----a-w c:\windows\system32\tracert.exe
2009-02-19 12:12 16,896 ----a-w c:\windows\system32\tsshutdn.exe
2009-02-19 12:12 14,848 ----a-w c:\windows\system32\tsdiscon.exe
2009-02-19 12:12 14,848 ----a-w c:\windows\system32\tscon.exe
2009-02-19 12:12 135,680 ----a-w c:\windows\system32\taskmgr.exe
2009-02-19 11:47 283,648 ----a-w c:\windows\winhlp32.exe
2009-02-19 11:46 30,720 ----a-w c:\windows\system32\xcopy.exe
2009-02-19 11:46 26,112 ----a-w c:\windows\twunk_32.exe
2009-02-19 11:46 15,360 ----a-w c:\windows\taskman.exe
2009-02-19 11:45 32,256 ----a-w c:\windows\system32\wupdmgr.exe
2009-02-19 11:45 165,888 ----a-w c:\windows\system32\wuauclt1.exe
2009-02-19 11:45 155,648 ----a-w c:\windows\system32\wscript.exe
2009-02-19 11:45 13,824 ----a-w c:\windows\system32\wscntfy.exe
2009-02-19 11:44 5,632 ----a-w c:\windows\system32\write.exe
2009-02-19 11:44 32,256 ----a-w c:\windows\system32\wpabaln.exe
2009-02-19 11:44 11,264 ----a-w c:\windows\system32\wpnpinst.exe
2009-02-19 11:43 8,192 ----a-w c:\windows\system32\winhlp32.exe
2009-02-19 11:43 5,632 ----a-w c:\windows\system32\winver.exe
2009-02-19 11:43 119,808 ----a-w c:\windows\system32\winmine.exe
2009-02-19 11:43 11,776 ----a-w c:\windows\system32\winmsd.exe
2009-02-19 11:42 65,024 ----a-w c:\windows\system32\wextract.exe
2009-02-19 11:42 433,664 ----a-w c:\windows\system32\wiaacmgr.exe
2009-02-19 11:40 49,664 ----a-w c:\windows\system32\w32tm.exe
2009-02-19 11:39 98,304 ----a-w c:\windows\system32\verifier.exe
2009-02-19 11:39 33,792 ----a-w c:\windows\system32\vssadmin.exe
2009-02-19 11:39 28,672 ----a-w c:\windows\system32\verclsid.exe
2009-02-19 11:38 77,824 ----a-w c:\windows\system32\usrmlnka.exe
2009-02-19 11:38 69,632 ----a-w c:\windows\system32\usrshuta.exe
2009-02-19 11:38 61,440 ----a-w c:\windows\system32\usrprbda.exe
2009-02-19 11:38 50,176 ----a-w c:\windows\system32\utilman.exe
2009-02-19 11:37 16,896 ----a-w c:\windows\system32\upnpcont.exe
2009-02-19 11:36 4,096 ----a-w c:\windows\system32\unlodctr.exe
2009-02-19 11:36 16,384 ----a-w c:\windows\system32\tskill.exe
2009-02-19 11:33 610,304 ----a-w c:\windows\system32\sspipes.scr
2009-02-19 11:33 47,104 ----a-w c:\windows\system32\ssmypics.scr
2009-02-19 11:33 20,992 ----a-w c:\windows\system32\ssmarque.scr
2009-02-19 11:33 18,944 ----a-w c:\windows\system32\ssmyst.scr
2009-02-19 11:32 393,216 ----a-w c:\windows\system32\ssflwbox.scr
2009-02-19 11:31 19,968 ----a-w c:\windows\system32\ssbezier.scr
2009-02-19 11:30 704,512 ----a-w c:\windows\system32\ss3dfo.scr
2009-02-19 11:30 12,800 ----a-w c:\windows\system32\spiisupd.exe
2009-02-19 11:29 56,832 ----a-w c:\windows\system32\sol.exe
2009-02-19 11:29 538,624 ----a-w c:\windows\system32\spider.exe
2009-02-19 11:29 24,576 ----a-w c:\windows\system32\sort.exe
2009-02-19 11:28 8,192 ----a-w c:\windows\system32\smbinst.exe
2009-02-19 11:28 73,728 ----a-w c:\windows\system32\slserv.exe
2009-02-19 11:28 138,752 ----a-w c:\windows\system32\sndvol32.exe
2009-02-19 11:28 131,584 ----a-w c:\windows\system32\sndrec32.exe
2009-02-19 11:27 70,144 ----a-w c:\windows\system32\sigverif.exe
2009-02-19 11:27 26,112 ----a-w c:\windows\system32\skeys.exe
2009-02-19 11:27 19,456 ----a-w c:\windows\system32\shutdown.exe
2009-02-19 11:26 9,728 ----a-w c:\windows\system32\sfc.exe
2009-02-19 11:26 77,824 ----a-w c:\windows\system32\shrpubw.exe
2009-02-19 11:26 32,768 ----a-w c:\windows\system32\setupn.exe
2009-02-19 11:26 14,848 ----a-w c:\windows\system32\shadow.exe
2009-02-19 11:25 31,232 ----a-w c:\windows\system32\sethc.exe
2009-02-19 11:25 23,040 ----a-w c:\windows\system32\setup.exe
2009-02-19 11:25 18,944 ----a-w c:\windows\system32\secedit.exe
2009-02-19 11:24 9,216 ----a-w c:\windows\system32\scrnsave.scr
2009-02-19 11:24 77,312 ----a-w c:\windows\system32\sdbinst.exe
2009-02-19 11:24 31,232 ----a-w c:\windows\system32\sc.exe
2009-02-19 11:24 121,856 ----a-w c:\windows\system32\schtasks.exe
2009-02-19 11:23 15,872 ----a-w c:\windows\system32\rwinsta.exe
2009-02-19 11:23 14,336 ----a-w c:\windows\system32\runonce.exe
2009-02-19 11:23 13,312 ----a-w c:\windows\system32\savedump.exe
2009-02-19 11:22 77,312 ----a-w c:\windows\system32\rtcshare.exe
2009-02-19 11:22 62,976 ----a-w c:\windows\system32\rsopprov.exe
2009-02-19 11:22 16,384 ----a-w c:\windows\system32\runas.exe
2009-02-19 11:22 107,520 ----a-w c:\windows\system32\rsnotify.exe
.
------- Sigcheck -------
2009-02-19 00:56 1033728 d1951b5f27bb42a500778133f4294a6c c:\windows\explorer.exe
2009-02-19 02:44 1032192 8b93053b25ce84cf9ee00b3dc12f8290 c:\windows\$NtServicePackUninstall$\explorer.exe
2009-02-19 03:17 1033728 d1951b5f27bb42a500778133f4294a6c c:\windows\ServicePackFiles\i386\explorer.exe
2009-02-19 03:45 1032192 8b93053b25ce84cf9ee00b3dc12f8290 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\explorer.exe
2009-02-19 04:15 1033728 d1951b5f27bb42a500778133f4294a6c c:\windows\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\explorer.exe
2009-02-19 04:48 1033728 d1951b5f27bb42a500778133f4294a6c c:\windows\system32\dllcache\explorer.exe
2009-02-19 02:41 15360 08c32a7077014158ba50884d6042067a c:\windows\$NtServicePackUninstall$\ctfmon.exe
2009-02-19 03:15 15360 83737cd06681d80ee6dead3e73eb8ad5 c:\windows\ServicePackFiles\i386\ctfmon.exe
2009-02-19 03:43 15360 08c32a7077014158ba50884d6042067a c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ctfmon.exe
2009-02-19 04:12 15360 83737cd06681d80ee6dead3e73eb8ad5 c:\windows\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\ctfmon.exe
2009-02-19 12:11 15360 83737cd06681d80ee6dead3e73eb8ad5 c:\windows\system32\ctfmon.exe
2009-02-19 04:46 15360 83737cd06681d80ee6dead3e73eb8ad5 c:\windows\system32\dllcache\ctfmon.exe
2009-02-19 02:58 57856 919edc7ff33070ab1ff1ad0d80e9f5dd c:\windows\$NtServicePackUninstall$\spoolsv.exe
2009-02-19 03:34 57856 6b9f964ad2940f717695c8995337e40e c:\windows\ServicePackFiles\i386\spoolsv.exe
2009-02-19 04:01 57856 919edc7ff33070ab1ff1ad0d80e9f5dd c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\spoolsv.exe
2009-02-19 04:31 57856 6b9f964ad2940f717695c8995337e40e c:\windows\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\spoolsv.exe
2009-02-19 12:11 57856 6b9f964ad2940f717695c8995337e40e c:\windows\system32\spoolsv.exe
2009-02-19 05:02 57856 6b9f964ad2940f717695c8995337e40e c:\windows\system32\dllcache\spoolsv.exe
2009-02-19 03:02 24576 7e8799bc3b82727b443adebd40e928c2 c:\windows\$NtServicePackUninstall$\userinit.exe
2009-02-19 03:37 26112 efe682c9771628f85bb0f49054bd40c2 c:\windows\ServicePackFiles\i386\userinit.exe
2009-02-19 04:04 24576 7e8799bc3b82727b443adebd40e928c2 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\userinit.exe
2009-02-19 04:34 26112 efe682c9771628f85bb0f49054bd40c2 c:\windows\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\userinit.exe
2009-02-19 12:11 26112 efe682c9771628f85bb0f49054bd40c2 c:\windows\system32\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-02-19 1470464]
"swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2009-02-19 171448]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2009-02-19 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-05-29 52840]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2007-10-07 125368]
"rfagent"="c:\program files\RFA\rfagent.exe" [2007-12-04 916800]
"nwiz"="nwiz.exe" [2009-02-19 c:\windows\system32\nwiz.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"PreXPSP2ShellProtocolBehavior"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!saswinlogon]
2007-04-19 12:41 294912 c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2009-02-19 12:11 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2009-02-19 01:00 1695232 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
--a------ 2009-02-19 01:11 233472 c:\program files\PowerISO\PWRISOVM.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2009-02-19 01:08 32768 c:\program files\Java\j2re1.4.2_04\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2009-02-19 00:15 171448 c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2009-02-19 04:37 77824 c:\windows\SOUNDMAN.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
R0 BootScreen;BootScreen;\SystemRoot\\SystemRoot\System32\drivers\vidstub.sys --> \SystemRoot\\SystemRoot\System32\drivers\vidstub.sys [?]
R1 sasdifsv;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-02-01 8944]
R1 saskutil;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-02-01 51440]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-02-18 99376]
R3 sasenum;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2006-02-16 4096]
S1 76b1e290;76b1e290;c:\windows\system32\drivers\76b1e290.sys --> c:\windows\system32\drivers\76b1e290.sys [?]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [2007-10-07 116664]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\VMC_PBStarter.exe
.
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\PCHealth\HelpCtr\System\panels\blank.htm
mLocal Page = c:\windows\PCHealth\HelpCtr\System\panels\blank.htm
TCP: {F00FE899-7F4E-421F-B517-57D4F758B99A} = 212.73.32.3 212.73.32.67
DPF: DirectAnimation Java Classes
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\tiw6q3rr.default\
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPJava14.dll
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPJPI142_04.dll
FF - plugin: c:\program files\Java\j2re1.4.2_04\bin\NPOJI610.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-02-21 22:54:06
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\Administrator\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(556)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2009-02-21 22:55:22
ComboFix-quarantined-files.txt 2009-02-21 22:54:59
Pre-Run: 150,339,125,248 bytes free
Post-Run: 150,377,140,224 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
372
P.S Explorer.exe runs on system startup.