Please find the post below:
Thanks...
Des.
ComboFix 09-05-12.04 - H Jardine 12/05/2009 22:03.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.1023.596 [GMT 1:00]
Running from: c:\documents and settings\H Jardine\My Documents\Downloads\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
.
((((((((((((((((((((((((( Files Created from 2009-04-12 to 2009-05-12 )))))))))))))))))))))))))))))))
.
2009-04-19 18:43 . 2009-04-19 18:43 -------- d-----w C:\rsit
2009-04-18 10:00 . 2009-04-18 11:43 -------- d-----w c:\documents and settings\H Jardine\DoctorWeb
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-04 15:38 . 2009-03-27 14:00 11952 ----a-w c:\windows\system32\avgrsstx.dll
2009-05-04 15:38 . 2009-03-27 14:00 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-04 15:38 . 2009-03-27 14:00 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-05-02 08:12 . 2009-04-09 01:06 -------- d-----w c:\program files\SUPERAntiSpyware
2009-04-19 17:51 . 2006-11-07 23:39 -------- d-----w c:\program files\Mozilla Thunderbird
2009-04-09 16:53 . 2009-04-09 16:53 -------- d-----w c:\program files\Panda Security
2009-04-09 16:01 . 2009-04-09 16:01 -------- d-----w c:\program files\CCleaner
2009-04-09 01:12 . 2005-06-13 16:34 -------- d-----w c:\program files\PCI Audio Applications
2009-04-09 01:06 . 2009-04-09 01:06 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-04-09 01:06 . 2009-04-09 01:06 -------- d-----w c:\documents and settings\H Jardine\Application Data\SUPERAntiSpyware.com
2009-04-09 01:06 . 2009-03-07 13:31 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-04-09 00:49 . 2009-04-09 00:49 -------- d-----w c:\program files\Trend Micro
2009-04-09 00:10 . 2009-04-09 00:10 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-08 16:29 . 2005-06-13 21:55 -------- d-----w c:\program files\Java
2009-04-08 14:15 . 2009-04-08 14:15 155 ----a-w c:\windows\system32\SelfDel.bat
2009-04-06 14:32 . 2009-04-09 00:10 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 14:32 . 2009-04-09 00:10 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-03-31 12:31 . 2009-03-31 12:31 -------- d-----w c:\program files\Common Files\xing shared
2009-03-31 12:30 . 2006-04-17 22:47 -------- d-----w c:\program files\Common Files\Real
2009-03-31 12:04 . 2008-05-10 11:44 -------- d-----w c:\program files\QuickTime
2009-03-31 12:03 . 2009-03-31 12:03 -------- d-----w c:\program files\Apple Software Update
2009-03-27 14:00 . 2009-03-27 14:00 -------- d-----w c:\program files\AVG
2009-03-26 19:46 . 2005-06-13 20:10 28720 ----a-w c:\documents and settings\H Jardine\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-24 17:12 . 2009-03-17 16:39 -------- d-----w c:\program files\Common Files\Macromedia
2009-03-24 17:12 . 2009-03-17 16:39 -------- d-----w c:\program files\Macromedia
2009-03-09 04:19 . 2009-02-07 13:21 410984 ----a-w c:\windows\system32\deploytk.dll
.
------- Sigcheck -------
[7] 2005-05-25 19:07 359936 63FDFEA54EB53DE2D863EE454937CE1E c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
[-] 2001-08-23 12:00 327168 E7774698BB0D14B0710A9A31E209F9B6 c:\windows\$NtServicePackUninstall$\tcpip.sys
[7] 2004-08-04 06:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\$NtUninstallKB893066$\tcpip.sys
[-] 2004-08-04 06:14 359040 1745B00FC1141404B28F4B94F69A8871 c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2005-05-25 19:04 359808 E1999538D7213DB7A05A660BA9D63658 c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-04-16_23.55.52 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-12 20:41 . 2009-05-12 20:41 16384 c:\windows\Temp\Perflib_Perfdata_c8.dat
+ 2009-05-12 20:41 . 2009-05-12 20:41 16384 c:\windows\Temp\Perflib_Perfdata_100.dat
+ 2001-08-23 12:00 . 2009-05-12 20:45 41792 c:\windows\system32\perfc009.dat
- 2001-08-23 12:00 . 2009-04-16 09:42 41792 c:\windows\system32\perfc009.dat
+ 2005-06-13 15:17 . 2001-08-23 12:00 19429 c:\windows\system32\MsDtc\Trace\msdtcvtr.bat
+ 2009-03-27 14:00 . 2009-05-04 15:38 27784 c:\windows\system32\drivers\avgmfx86.sys
+ 2001-08-23 12:00 . 2009-05-12 20:45 315062 c:\windows\system32\perfh009.dat
- 2001-08-23 12:00 . 2009-04-16 09:42 315062 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"kdx"="c:\program files\Kontiki\KHost.exe" [2008-02-27 1032376]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-02-27 1310720]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus DX4800 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE" [2005-02-02 98304]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"LVCOMS"="c:\program files\Common Files\Logitech\QCDriver\LVCOMS.EXE" [2001-11-13 98304]
"DT LGE"="c:\program files\Portrait Displays\forteManager\DTHtml.exe" [2007-06-12 291328]
"O2"="c:\program files\O2\bin\sprtcmd.exe" [2008-03-28 198184]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"EPSON Stylus DX4800 Series (Copy 1)"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE" [2005-02-02 98304]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-04 1947928]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-31 198160]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"C-Media Mixer"="Mixer.exe" - c:\windows\mixer.exe [2002-10-15 1818624]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-10-22 1622016]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-6-20 110592]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-02-27 10:39 282624 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-04 15:38 11952 ----a-w c:\windows\system32\avgrsstx.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk
backup=c:\windows\pss\Picture Package Menu.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package VCD Maker.lnk
backup=c:\windows\pss\Picture Package VCD Maker.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^H Jardine^Start Menu^Programs^Startup^Registration THE SETTLERS - Heritage of Kings.LNK]
path=c:\documents and settings\H Jardine\Start Menu\Programs\Startup\Registration THE SETTLERS - Heritage of Kings.LNK
backup=c:\windows\pss\Registration THE SETTLERS - Heritage of Kings.LNKStartup
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\EA GAMES\\The Battle for Middle-earth \\game.dat"=
"c:\\Program Files\\Quake III Arena\\quake3.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"=
"c:\\Program Files\\O2\\bin\\wificfg.exe"=
"c:\\Program Files\\O2\\agent\\bin\\bcont.exe"=
"c:\\Program Files\\Common Files\\SupportSoft\\bin\\ssrc.exe"=
"c:\\Program Files\\O2\\agent\\bin\\bcont_nm.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [09/04/2009 17:53 28544]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [27/03/2009 15:00 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [27/03/2009 15:00 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [10/10/2006 12:53 5632]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [27/02/2007 11:39 32256]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [27/03/2009 15:00 298776]
R2 sprtsvc_O2;SupportSoft Sprocket Service (O2);c:\program files\O2\bin\sprtsvc.exe [07/06/2007 16:19 202280]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [16/02/2006 16:51 4096]
.
Contents of the 'Scheduled Tasks' folder
2009-03-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\H Jardine\Application Data\Mozilla\Firefox\Profiles\sjd1pyyb.default\
FF - prefs.js: browser.search.selectedEngine - Google.co.uk
FF - prefs.js: browser.startup.homepage - hxxp://start.mozilla.org/firefox?client=firefox-a&rls=org.mozilla:en-GB:official
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npBBCPlugin.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-12 22:06
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1801674531-1202660629-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(612)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2009-05-12 22:07
ComboFix-quarantined-files.txt 2009-05-12 21:07
ComboFix2.txt 2009-04-17 00:26
ComboFix3.txt 2009-04-17 00:00
ComboFix4.txt 2009-04-09 18:10
Pre-Run: 8,390,537,216 bytes free
Post-Run: 8,374,775,808 bytes free
179