ComboFix 07-10-07.2 - gg 2007-10-10  1:36:34.4 - [color=red][b]FAT32[/b][/color]x86 
Microsoft Windows XP Professional  5.1.2600.1.1252.1.1033.18.314 [GMT -5:00]
Running from: C:\Documents and Settings\gg\Desktop\spyware stuff\ComboFix.exe
.

(((((((((((((((((((((((((   Files Created from 2007-09-10 to 2007-10-10  )))))))))))))))))))))))))))))))
.

2007-10-09 23:58	741,632	--a------	C:\WINDOWS\SYSTEM32\axaadgua.dat
2007-10-09 23:58	35,584	--a------	C:\WINDOWS\SYSTEM32\blursnbw.dat
2007-10-09 23:58	34,560	--a------	C:\WINDOWS\SYSTEM32\hzihaumx.dat
2007-10-09 23:58	118,528	--a------	C:\WINDOWS\SYSTEM32\ksusyvoa.dat
2007-10-09 22:55	10,872	--a------	C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2007-10-07 12:25	51,200	--a------	C:\WINDOWS\NirCmd.exe
2007-10-06 22:20	<DIR>	d--------	C:\Documents and Settings\gg\Application Data\Leadertech
2007-10-06 16:20	22,752	--a------	C:\WINDOWS\SYSTEM32\spupdsvc.exe
2007-10-06 16:20	<DIR>	d--h-----	C:\WINDOWS\$hf_mig$
2007-10-06 16:19	7,680	---------	C:\WINDOWS\SYSTEM32\dllcache\bitsprx2.dll
2007-10-06 16:19	7,680	---------	C:\WINDOWS\SYSTEM32\bitsprx2.dll
2007-10-06 16:19	7,168	---------	C:\WINDOWS\SYSTEM32\dllcache\bitsprx3.dll
2007-10-06 16:19	7,168	---------	C:\WINDOWS\SYSTEM32\bitsprx3.dll
2007-10-06 16:19	331,776	--a------	C:\WINDOWS\SYSTEM32\winhttp.dll
2007-10-06 16:19	17,408	--a------	C:\WINDOWS\SYSTEM32\qmgrprxy.dll
2007-10-06 16:19	158,720	---------	C:\WINDOWS\SYSTEM32\xpob2res.dll
2007-10-06 16:19	<DIR>	d--------	C:\WINDOWS\SYSTEM32\bits
2007-10-06 16:17	549,720	--a------	C:\WINDOWS\SYSTEM32\wuapi.dll
2007-10-06 16:17	43,352	--a------	C:\WINDOWS\SYSTEM32\wups2.dll
2007-10-06 16:17	33,624	--a------	C:\WINDOWS\SYSTEM32\wups.dll
2007-10-06 16:17	325,976	--a------	C:\WINDOWS\SYSTEM32\wucltui.dll
2007-10-06 11:23	<DIR>	d--------	C:\WINDOWS\ServicePackFiles
2007-10-06 11:23	<DIR>	d--------	C:\WINDOWS\ehome
2007-10-06 11:13	2,028,640	--a------	C:\sp1aexpress_usa.exe
2007-10-03 00:12	<DIR>	d--------	C:\Program Files\ToniArts
2007-10-02 22:35	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Google
2007-10-02 22:01	<DIR>	d--------	C:\Program Files\backups
2007-09-30 19:55	34,816	--a------	C:\WINDOWS\SYSTEM32\dllcache\admwprox.dll
2007-09-30 19:52	73,728	--a------	C:\WINDOWS\SYSTEM32\dllcache\icwtutor.exe
2007-09-30 19:52	61,440	--a------	C:\WINDOWS\SYSTEM32\dllcache\icwres.dll
2007-09-30 19:52	57,344	--a------	C:\WINDOWS\SYSTEM32\dllcache\icwconn.dll
2007-09-30 19:52	45,056	--a------	C:\WINDOWS\SYSTEM32\dllcache\icwutil.dll
2007-09-30 19:52	40,960	--a------	C:\WINDOWS\SYSTEM32\dllcache\trialoc.dll
2007-09-30 19:52	24,576	--a------	C:\WINDOWS\SYSTEM32\dllcache\icwrmind.exe
2007-09-30 19:52	155,648	--a------	C:\WINDOWS\SYSTEM32\dllcache\icwhelp.dll
2007-09-30 19:47	153,631	--a------	C:\WINDOWS\SYSTEM32\DRIVERS\el90xnd5.sys
2007-09-30 19:45	24,661	--a------	C:\WINDOWS\SYSTEM32\spxcoins.dll
2007-09-30 19:45	24,661	--a------	C:\WINDOWS\SYSTEM32\dllcache\spxcoins.dll
2007-09-30 19:45	13,312	--a------	C:\WINDOWS\SYSTEM32\irclass.dll
2007-09-30 19:45	13,312	--a------	C:\WINDOWS\SYSTEM32\dllcache\irclass.dll
2007-09-30 19:10	<DIR>	d--hs----	C:\FOUND.051
2007-09-30 18:52	<DIR>	d--hs----	C:\FOUND.050
2007-09-30 18:27	246,545	--a------	C:\WINDOWS\SYSTEM32\libssl32.dll
2007-09-30 18:27	1,188,375	--a------	C:\WINDOWS\SYSTEM32\libeay32.dll
2007-09-30 17:01	<DIR>	d--------	C:\WINDOWS\SYSTEM32\AppCert
2007-09-30 17:00	92,672	--a------	C:\WINDOWS\SYSTEM32\netmanm.dll
2007-09-15 20:38	<DIR>	d--------	C:\Program Files\City Interactive
2007-09-15 20:27	<DIR>	d--hs----	C:\FOUND.049
2007-09-14 11:02	<DIR>	d--hs----	C:\FOUND.048

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-07-30 19:19	92504	--a------	C:\WINDOWS\SYSTEM32\dllcache\cdm.dll
2007-07-30 19:19	92504	--a------	C:\WINDOWS\SYSTEM32\cdm.dll
2007-07-30 19:19	53080	--a------	C:\WINDOWS\SYSTEM32\wuauclt.exe
2007-07-30 19:19	53080	--a------	C:\WINDOWS\SYSTEM32\dllcache\wuauclt.exe
2007-07-30 19:19	1712984	--a------	C:\WINDOWS\SYSTEM32\wuaueng.dll
2007-07-30 19:19	1712984	--a------	C:\WINDOWS\SYSTEM32\dllcache\wuaueng.dll
2006-03-28 09:49	1381	--a------	C:\Program Files\hijackthis.log
2006-03-26 18:15	271	---hs----	C:\Program Files\desktop.ini
2006-03-26 18:15	23357	---h-----	C:\Program Files\folder.htt
2005-02-16 11:06	218112	--a------	C:\Program Files\HijackThis.exe
.

(((((((((((((((((((((((((((((   snapshot@2007-10-07_12.34.37.31   )))))))))))))))))))))))))))))))))))))))))
.
----a-w            50,532 2007-10-08 15:12:06  C:\WINDOWS\SYSTEM32\perfc009.dat
----a-w           374,064 2007-10-08 15:12:06  C:\WINDOWS\SYSTEM32\perfh009.dat
----a-w           821,728 2007-10-10 03:52:04  C:\WINDOWS\SYSTEM32\DRIVERS\avg7core.sys
----a-w             4,224 2007-10-10 03:52:10  C:\WINDOWS\SYSTEM32\DRIVERS\avg7rsw.sys
----a-w            27,776 2007-10-10 03:52:10  C:\WINDOWS\SYSTEM32\DRIVERS\avg7rsxp.sys
----a-w            19,904 2007-10-10 03:52:12  C:\WINDOWS\SYSTEM32\DRIVERS\avgmfx86.sys
----a-w             4,960 2007-10-10 03:52:12  C:\WINDOWS\SYSTEM32\DRIVERS\avgtdi.sys
----a-w             3,968 2007-10-10 03:52:12  C:\WINDOWS\SYSTEM32\DRIVERS\avgclean.sys
----a-w           372,736 2007-10-10 04:48:06  C:\WINDOWS\SYSTEM32\config\systemprofile\ntuser.dat
----a-w            32,768 2007-10-10 06:33:58  C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\History\History.IE5\index.dat
----a-w            32,768 2007-10-10 06:36:18  C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
----a-w            32,768 2007-10-10 06:33:58  C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\index.dat
----a-w           163,328 2007-03-13 15:57:12  C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE
.
----a-w            50,532 2007-10-07 04:11:38  C:\WINDOWS\SYSTEM32\perfc009.dat
----a-w           374,064 2007-10-07 04:11:38  C:\WINDOWS\SYSTEM32\perfh009.dat
----a-w           372,736 2007-10-07 17:26:32  C:\WINDOWS\SYSTEM32\config\systemprofile\ntuser.dat
----a-w            32,768 2007-10-07 17:23:16  C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\History\History.IE5\index.dat
----a-w            49,152 2007-10-07 17:23:16  C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
----a-w            32,768 2007-10-07 17:23:16  C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\index.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{460EF089-7F9E-427A-BE1F-72587251EF40}]
2007-10-09 23:49	92672	--a------	c:\windows\system32\netmanm.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Motive SmartBridge"="C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [2005-08-24 07:51]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-03-09 15:29]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41]
"nwiz"="nwiz.exe" [2006-03-09 15:29 C:\WINDOWS\SYSTEM32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2006-03-09 15:29]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-10-09 22:52]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wuhausyx] 
netmanm.dll 2007-10-09 23:49 92672 C:\WINDOWS\SYSTEM32\netmanm.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AT&T Self Support Tool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AT&T Self Support Tool.lnk
backup=C:\WINDOWS\pss\AT&T Self Support Tool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=C:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

R0 BsStor;InCD Storage Helper Driver;C:\WINDOWS\System32\DRIVERS\bsstor.sys
R2 dtaioade;3Com EtherLink XL 90X Adapter Controller;C:\WINDOWS\System32\svchost.exe -k netsvcs
R2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe
R3 EL90X;3Com EtherLink XL 90X Adapter Driver;C:\WINDOWS\System32\DRIVERS\el90xnd5.sys
R3 wdm_opl3sax;YAMAHA OPL3-SAx Audio Driver (WDM);C:\WINDOWS\System32\drivers\opl3sax.sys
S3 Ptserlp;PCTEL Serial Device Driver for PCI;C:\WINDOWS\System32\DRIVERS\ptserlp.sys
S4 BsUDF;InCD UDF Driver;C:\WINDOWS\System32\drivers\BsUDF.sys

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
dtaioade

.
Contents of the 'Scheduled Tasks' folder
"2007-10-07 04:00:02 C:\WINDOWS\Tasks\Tune-up Application Start.job"
"2007-10-10 04:41:02 C:\WINDOWS\Tasks\PCHealth Scheduler for Data Collection.job"
"2007-10-10 04:01:02 C:\WINDOWS\Tasks\Uninstall Expiration Reminder.job"
- C:\WINDOWS\System32\OOBE\oobebaln.exe
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-10 01:38:19
Windows 5.1.2600 Service Pack 1 FAT NTAPI

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully 
hidden files: 0 

**************************************************************************
.
Completion time: 2007-10-10  1:41:02
C:\ComboFix3.txt ... 2007-10-08 10:25
C:\ComboFix2.txt ... 2007-10-09 23:55
C:\ComboFix-quarantined-files.txt ... 2007-10-10 01:40
.
	--- E O F ---