ComboFix 07-12-21.4 - Dan 2007-12-28 23:19:31.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.672 [GMT -5:00] Running from: D:\Junk\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\x64 . ((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-29 ))))))))))))))))))))))))))))))) . 2007-12-21 02:00 . 2006-10-06 19:09 155,648 --a------ C:\WINDOWS\system32\igfxres.dll 2007-12-21 01:59 . 2007-12-21 01:59 d-------- C:\WINDOWS\system32\Lang 2007-12-21 01:59 . 2006-10-06 22:19 200,704 --a------ C:\WINDOWS\system32\igfxCoIn_v4704.dll 2007-12-18 00:47 . 2007-12-18 00:47 d-------- C:\Intel 2007-12-17 15:14 . 2007-12-17 15:15 626 --a------ C:\regfix.reg 2007-12-17 15:03 . 2007-12-17 15:03 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-12-17 15:03 . 2007-12-17 15:03 d-------- C:\Documents and Settings\Dan\Application Data\SUPERAntiSpyware.com 2007-12-17 15:03 . 2007-12-17 15:03 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2007-12-16 21:14 . 2007-12-20 14:49 91,492 --a------ C:\WINDOWS\system32\drivers\klin.dat 2007-12-16 21:14 . 2007-12-16 21:20 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat 2007-12-16 21:13 . 2007-12-16 21:13 d-------- C:\Program Files\Kaspersky Lab 2007-12-16 21:13 . 2007-12-28 23:22 89,006,880 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-12-16 21:13 . 2007-12-28 13:47 1,187,444 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2007-12-16 21:13 . 2007-12-28 23:22 138,016 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2007-12-16 21:13 . 2007-12-28 13:47 16,568 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2007-12-16 19:47 . 2007-12-16 19:47 d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-12-15 13:42 . 2007-12-15 13:43 d-------- C:\Program Files\RenGames 2007-12-07 04:13 . 2007-12-07 04:13 5,376 --a------ C:\WINDOWS\system32\drivers\MS1000.sys 2007-12-05 01:51 . 2002-08-12 12:51 4,227,072 --a------ C:\WINDOWS\system32\qt-mt305.dll 2007-12-04 10:41 . 2007-12-28 13:48 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2007-12-04 10:40 . 2007-12-04 10:40 d-------- C:\KAV 2007-12-02 21:04 . 2007-12-16 17:05 d-------- C:\WINDOWS\SxsCaPendDel 2007-12-02 17:40 . 2007-12-16 16:59 121 --a------ C:\WINDOWS\bdagent.INI 2007-12-02 17:39 . 2007-12-16 03:17 81,984 --a------ C:\WINDOWS\system32\bdod.bin 2007-12-02 13:53 . 2007-12-04 11:25 d-------- C:\Program Files\Enigma Software Group 2007-12-02 13:49 . 2007-12-02 13:49 56,200 --ah----- C:\WINDOWS\system32\mlfcache.dat 2007-12-02 10:53 . 2007-12-02 10:53 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files 2007-12-01 22:51 . 2007-12-01 22:51 d-------- C:\Documents and Settings\All Users\Application Data\Eset 2007-11-29 08:36 . 2007-11-29 08:36 d-------- C:\Documents and Settings\Dan\Application Data\Media Player Classic 2007-11-29 06:56 . 2007-11-29 07:45 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb 2007-11-29 06:56 . 2007-11-29 07:45 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb 2007-11-29 06:44 . 2007-11-29 07:45 d-------- C:\Program Files\Windows Media Connect 2 2007-11-29 06:44 . 2006-10-04 09:06 1,197,294 --------- C:\WINDOWS\system32\dllcache\sysmain.sdb 2007-11-29 06:44 . 2006-10-04 09:06 764,868 --------- C:\WINDOWS\system32\dllcache\apph_sp.sdb 2007-11-29 06:44 . 2006-10-04 09:06 217,118 --------- C:\WINDOWS\system32\dllcache\apphelp.sdb 2007-11-29 06:42 . 2007-11-29 07:44 d-------- C:\WINDOWS\system32\drivers\UMDF 2007-11-29 05:52 . 2007-11-29 05:52 d-------- C:\Program Files\XP Codec Pack . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-28 18:14 --------- d-----w C:\Documents and Settings\Dan\Application Data\uTorrent 2007-12-28 10:03 --------- d-----w C:\Documents and Settings\Dan\Application Data\Skype 2007-12-28 07:54 --------- d-----w C:\Program Files\Google 2007-12-28 05:35 --------- d-----w C:\Program Files\PokerStars 2007-12-16 08:29 77,824 ----a-w C:\WINDOWS\system32\xcomm.dll 2007-12-05 06:51 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-29 00:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ahead 2007-11-29 00:26 --------- d-----w C:\Program Files\Common Files\Ahead 2007-11-29 00:24 --------- d-----w C:\Program Files\Nero 2007-11-29 00:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero 2007-11-28 10:33 3,532 ----a-w C:\drmHeader.bin 2007-11-26 03:30 --------- d-----w C:\Program Files\MSN Messenger 2007-11-22 03:26 --------- d-----w C:\Documents and Settings\Dan\Application Data\Microgaming 2007-11-16 10:03 69,689 ----a-w C:\WINDOWS\UNZIP.DLL 2007-11-16 10:03 507,904 ----a-w C:\WINDOWS\TMUPDATE.DLL 2007-11-16 10:03 286,720 ----a-w C:\WINDOWS\PATCH.EXE 2007-11-14 07:26 450,560 ------w C:\WINDOWS\system32\dllcache\jscript.dll 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-11-12 10:39 --------- d-----w C:\Program Files\delta 2007-11-12 10:02 --------- d-----w C:\Program Files\Common Files\Adobe 2007-11-11 10:56 881,152 ----a-w C:\WinRAR.exe 2007-11-08 09:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-11-08 09:47 --------- d-----w C:\Documents and Settings\Dan\Application Data\AdobeUM 2007-11-08 09:16 22 ----a-w C:\zipnew.dat 2007-11-08 09:16 20 ----a-w C:\rarnew.dat 2007-11-08 07:48 5,120 ----a-w C:\dllh0st.exe 2007-11-08 07:02 218,112 ----a-w C:\hijackthis.exe 2007-11-05 09:38 --------- d-----w C:\Documents and Settings\Dan\Application Data\Apple Computer 2007-11-05 09:35 --------- d-----w C:\Program Files\Apple Software Update 2007-11-05 09:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple 2007-10-30 09:55 3,065,856 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-10-30 09:04 --------- d-----w C:\Documents and Settings\Dan\Application Data\Corel 2007-10-29 22:35 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-29 22:35 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll 2007-10-28 11:19 --------- d-----w C:\Program Files\uTorrent 2007-10-28 02:15 102,664 ----a-w C:\WINDOWS\system32\drivers\tmcomm.sys 2007-10-27 22:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll 2007-10-27 22:40 222,720 ------w C:\WINDOWS\system32\dllcache\wmasf.dll 2007-10-26 03:34 8,460,288 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll 2007-10-11 05:57 96,256 ------w C:\WINDOWS\system32\dllcache\inseng.dll 2007-10-11 05:57 666,112 ------w C:\WINDOWS\system32\dllcache\wininet.dll 2007-10-11 05:57 617,984 ------w C:\WINDOWS\system32\dllcache\urlmon.dll 2007-10-11 05:57 55,808 ------w C:\WINDOWS\system32\dllcache\extmgr.dll 2007-10-11 05:57 532,480 ------w C:\WINDOWS\system32\dllcache\mstime.dll 2007-10-11 05:57 474,112 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll 2007-10-11 05:57 449,024 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-10-11 05:57 39,424 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-10-11 05:57 357,888 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-10-11 05:57 251,904 ------w C:\WINDOWS\system32\dllcache\iepeers.dll 2007-10-11 05:57 205,824 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-10-11 05:57 16,384 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-10-11 05:57 151,040 ------w C:\WINDOWS\system32\dllcache\cdfview.dll 2007-10-11 05:57 146,432 ------w C:\WINDOWS\system32\dllcache\msrating.dll 2007-10-11 05:57 1,498,112 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll 2007-10-11 05:57 1,054,208 ------w C:\WINDOWS\system32\dllcache\danim.dll 2007-10-11 05:57 1,024,000 ------w C:\WINDOWS\system32\dllcache\browseui.dll 2007-10-10 10:48 18,432 ------w C:\WINDOWS\system32\dllcache\iedw.exe 2007-06-23 21:46 87,608 ----a-w C:\Documents and Settings\Dan\Application Data\ezpinst.exe 2007-06-23 21:46 47,360 ----a-w C:\Documents and Settings\Dan\Application Data\pcouffin.sys 2005-08-08 17:40 483 ----a-w C:\Program Files\rarreg.key . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 06:00] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-06-28 12:51] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2005-09-26 19:34] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= D:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] D:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 D:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ymetray.lnk] backup=C:\WINDOWS\pss\ymetray.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2007-10-10 19:51 39792 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] 2007-06-27 19:03 152872 --a------ C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BuildBU] 2004-02-19 08:23 61440 --a------ c:\dell\bldbubg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader] 2006-08-14 15:20 462336 --a------ C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] 2004-08-10 06:00 15360 --a------ C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellHelp] C:\Dell\DellHelp\DellHelp.exe /c [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport] C:\Program Files\Dell Support\DSAgnt.exe /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA] 2005-09-08 06:20 122940 --a------ C:\WINDOWS\System32\DLA\DLACTRLW.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher] 2005-10-05 04:12 94208 --a------ C:\Program Files\Dell\Media Experience\DMXLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray] 2005-09-29 15:01 67584 --a------ C:\WINDOWS\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] 2006-10-06 19:13 114688 --a------ C:\WINDOWS\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif] 2006-07-06 08:15 151552 --a------ C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] 2006-10-06 19:11 98304 --a------ C:\WINDOWS\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -start [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McRegWiz] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Update Services] svhost32.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2007-03-01 15:57 153136 --a------ C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence] 2006-10-06 19:10 94208 --a------ C:\WINDOWS\system32\igfxpers.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] D:\Program Files\QuickTime\QTTask.exe -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1] C:\WINDOWS\mrofinu904.exe 61A847B5BBF7281B329F284503996897C881250221C8670836AC4FA7C8833201749139 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp] stsystra.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyHunter] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2007-03-14 02:43 83608 --a------ C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware] 2007-06-21 14:06 1318912 --a------ D:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck] C:\WINDOWS\system32\dumprep 0 -u [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Registry Repair Pro] D:\Program Files\3B Software\Windows Registry Repair Pro\RegistryRepairPro.exe 4 R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 14:58] S3 MS1000;MS1000;C:\WINDOWS\system32\DRIVERS\MS1000.sys [2007-12-07 04:13] S3 NAL;Nal Service ;C:\WINDOWS\system32\Drivers\iqvw32.sys [2006-06-05 04:39] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}] \Shell\AutoRun\command - D:\Program Files\ESET\Install\setup.exe *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-28 23:22:21 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\WINDOWS\WindowsShell.Manifest 749 bytes C:\WINDOWS\WindowsUpdate.log 1867338 bytes C:\WINDOWS\winhelp.exe 256192 bytes C:\WINDOWS\winhlp32.exe 283648 bytes executable C:\WINDOWS\wininit.ini 126 bytes C:\WINDOWS\winnt.bmp 48680 bytes C:\WINDOWS\winnt256.bmp 48680 bytes C:\WINDOWS\WinSxS C:\WINDOWS\WMFDist11.log 55015 bytes C:\WINDOWS\WMFDist11Uninst.log 13888 bytes C:\WINDOWS\wmp11.log 32832 bytes C:\WINDOWS\wmp11Uninst.log 10317 bytes C:\WINDOWS\wmsetup.log 167463 bytes C:\WINDOWS\wmsetup10.log 5175 bytes C:\WINDOWS\WMSysPr9.prx 316640 bytes C:\WINDOWS\Wudf01000Inst.log 13920 bytes C:\WINDOWS\XpsEPSC.log 30093 bytes C:\WINDOWS\xpsp1hfm.log 1073 bytes C:\WINDOWS\Zapotec.bmp 9522 bytes C:\WINDOWS\_default.pif 707 bytes scan completed successfully hidden files: 20 ************************************************************************** . Completion time: 2007-12-28 23:23:50 . 2007-12-22 00:07:07 --- E O F ---