watcherduck
Found it in C:
Combofix.txt
ComboFix 09-12-26.05 - Donald 12/27/2009 12:13:39.1.4 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3327.2781 [GMT -10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
((((((((((((((((((((((((( Files Created from 2009-11-27 to 2009-12-27 )))))))))))))))))))))))))))))))
.
2009-12-27 17:35 . 2009-12-27 17:35 ——– d—–w- c:\program files\Trend Micro
2009-12-27 04:25 . 2009-12-04 02:14 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-27 04:25 . 2009-12-04 02:13 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-27 04:25 . 2009-12-27 04:25 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-12-24 20:08 . 2008-04-14 00:12 26624 —-a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-12-24 20:01 . 2009-12-24 20:01 ——– d—–w- c:\documents and settings\Donald\Application Data\Malwarebytes
2009-12-24 20:01 . 2009-12-24 20:01 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-24 18:23 . 2009-12-24 18:23 ——– d—–w- c:\documents and settings\Donald\Application Data\Alien Skin
2009-12-24 17:56 . 2009-12-24 17:56 ——– d—–w- c:\program files\Alien Skin
2009-12-24 07:08 . 2009-12-27 02:49 52224 —-a-w- c:\documents and settings\Donald\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2009-12-24 07:08 . 2009-12-27 02:49 117760 —-a-w- c:\documents and settings\Donald\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-12-24 07:07 . 2009-12-24 07:07 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-12-24 07:07 . 2009-12-24 07:07 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-12-24 07:07 . 2009-12-24 07:07 ——– d—–w- c:\documents and settings\Donald\Application Data\SUPERAntiSpyware.com
2009-12-24 07:07 . 2009-12-24 07:07 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-12-24 07:04 . 2009-12-27 03:04 ——– d—–w- c:\program files\SpywareBlaster
2009-12-24 06:00 . 2009-12-24 06:00 ——– d—–w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-12-24 05:46 . 2009-08-07 05:23 215920 —-a-w- c:\windows\system32\muweb.dll
2009-12-24 05:46 . 2009-08-07 05:23 274288 —-a-w- c:\windows\system32\mucltui.dll
2009-12-24 05:44 . 2008-04-01 07:24 676224 —-a-w- c:\windows\system32\OGACheckControl.dll
2009-12-24 05:33 . 2008-11-10 21:41 32656 —-a-w- c:\windows\system32\msonpmon.dll
2009-12-24 05:33 . 2006-10-27 05:56 33104 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2009-12-24 05:32 . 2009-12-24 06:57 ——– d—–w- c:\program files\Microsoft Works
2009-12-24 05:31 . 2009-12-24 05:31 ——– d—–w- c:\program files\Microsoft.NET
2009-12-24 05:30 . 2009-12-24 05:30 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2009-12-24 05:30 . 2009-12-24 05:32 ——– d—–w- c:\windows\SHELLNEW
2009-12-24 05:29 . 2009-12-24 05:29 ——– d—–w- c:\documents and settings\Donald\Local Settings\Application Data\Microsoft Help
2009-12-24 05:29 . 2009-12-24 06:58 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-24 05:29 . 2009-12-24 05:29 ——– d—–r- C:\MSOCache
2009-12-24 05:25 . 2009-12-24 05:25 323584 —-a-w- c:\windows\system32\AUDIOGENIE2.DLL
2009-12-24 05:23 . 2009-12-24 05:27 ——– d—–w- c:\program files\Replay Music 3
2009-12-24 05:23 . 2009-12-24 05:23 ——– d—–w- c:\windows\Replay Music
2009-12-24 05:08 . 2009-12-24 06:01 ——– d—–w- c:\documents and settings\Donald\Local Settings\Application Data\ApplicationHistory
2009-12-24 04:57 . 2009-12-24 04:57 ——– d—–w- c:\documents and settings\Donald\Local Settings\Application Data\Yahoo
2009-12-24 04:43 . 2009-12-24 04:43 ——– d—–w- c:\documents and settings\Donald\Application Data\Yahoo!
2009-12-24 04:42 . 2009-12-24 04:42 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-12-24 04:42 . 2009-11-11 00:39 607472 —-a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-12-24 04:39 . 2009-12-24 04:42 ——– d—–w- c:\program files\Yahoo!
2009-12-24 04:17 . 2009-12-24 04:17 ——– d—–w- c:\documents and settings\Donald\Application Data\Outertech
2009-12-24 04:14 . 2009-12-24 04:16 ——– d—–w- c:\program files\Get Diz
2009-12-24 03:49 . 2009-06-25 04:24 3734976 —-a-w- c:\windows\system32\drivers\RtKHDMI.sys
2009-12-24 03:49 . 2009-04-01 19:58 1200128 —-a-w- c:\windows\RtkUpd.exe
2009-12-24 03:49 . 2009-04-01 00:15 39936 —-a-w- c:\windows\system32\RHCoInstXP.dll
2009-12-24 03:33 . 2009-12-24 03:33 ——– d—–w- c:\program files\Microsoft Silverlight
2009-12-24 03:32 . 2009-12-24 03:32 ——– d—–w- c:\program files\Windows Media Connect 2
2009-12-24 03:31 . 2009-12-24 03:31 ——– d—–w- c:\windows\system32\drivers\UMDF
2009-12-24 03:31 . 2009-12-24 03:31 ——– d—–w- c:\windows\system32\LogFiles
2009-12-24 03:30 . 2009-12-24 03:30 ——– d—–w- c:\windows\system32\URTTEMP
2009-12-24 03:01 . 2009-12-24 03:01 ——– d—–w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-12-24 02:58 . 2009-12-24 02:58 ——– d—–w- c:\documents and settings\Donald\Local Settings\Application Data\Adobe
2009-12-24 02:50 . 2009-12-24 02:50 ——– d—–w- c:\program files\Common Files\Macrovision Shared
2009-12-24 02:50 . 2008-04-07 15:38 22872 —-a-r- c:\windows\system32\AdobePDFUI.dll
2009-12-24 02:50 . 2008-04-07 15:38 45392 —-a-r- c:\windows\system32\AdobePDF.dll
2009-12-24 02:48 . 2009-12-24 02:50 ——– d—–w- c:\program files\Common Files\Adobe
2009-12-24 02:20 . 2009-12-24 02:20 ——– d—–w- c:\documents and settings\Donald\Application Data\Jasc
2009-12-24 02:17 . 2009-12-24 02:17 ——– d—–w- c:\documents and settings\All Users\Application Data\InstallShield
2009-12-24 02:16 . 2009-12-24 02:16 ——– d—–w- c:\program files\Common Files\Jasc Software Inc
2009-12-24 02:16 . 2009-12-24 02:20 ——– d—–w- c:\program files\Jasc Software Inc
2009-12-24 02:16 . 2009-12-24 02:16 ——– d—–w- c:\documents and settings\Donald\Application Data\Jasc Software Inc
2009-12-24 02:05 . 2009-12-24 02:14 ——– d—–w- c:\program files\Microsoft Picture It! 9
2009-12-24 01:55 . 2009-12-24 01:55 ——– d—–w- c:\program files\Unlocker
2009-12-24 01:54 . 2009-12-24 01:54 ——– d—–w- c:\documents and settings\Donald\Local Settings\Application Data\ESET
2009-12-24 01:38 . 2009-12-26 23:41 ——– d—–w- c:\documents and settings\Donald\Application Data\ieSpell
2009-12-24 01:36 . 2009-12-24 01:36 ——– d—–w- c:\program files\ieSpell
2009-12-24 01:36 . 2009-11-21 15:51 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2009-12-24 01:31 . 2009-06-21 21:44 153088 -c—-w- c:\windows\system32\dllcache\triedit.dll
2009-12-24 01:31 . 2009-07-10 13:27 1315328 -c—-w- c:\windows\system32\dllcache\msoe.dll
2009-12-24 01:27 . 2008-12-11 10:57 333952 -c—-w- c:\windows\system32\dllcache\srv.sys
2009-12-24 01:27 . 2008-10-24 11:21 455296 -c—-w- c:\windows\system32\dllcache\mrxsmb.sys
2009-12-24 01:26 . 2009-07-31 04:35 1172480 -c—-w- c:\windows\system32\dllcache\msxml3.dll
2009-12-24 01:26 . 2008-10-15 16:34 337408 -c—-w- c:\windows\system32\dllcache\netapi32.dll
2009-12-24 00:07 . 2009-12-24 00:07 ——– d—–w- c:\documents and settings\Donald\Application Data\HP
2009-12-24 00:06 . 2009-12-24 00:06 ——– d—–w- c:\documents and settings\All Users\Application Data\HPSSUPPLY
2009-12-24 00:05 . 2009-12-24 00:06 ——– d—–w- c:\documents and settings\All Users\Application Data\HP
2009-12-24 00:05 . 2009-12-24 00:06 ——– d—–w- c:\program files\Common Files\HP
2009-12-24 00:05 . 2009-12-24 00:05 ——– d—–w- c:\program files\Hewlett-Packard
2009-12-24 00:05 . 2009-12-24 00:05 ——– d—–w- c:\program files\Common Files\Hewlett-Packard
2009-12-24 00:05 . 2009-12-24 00:05 ——– d—–w- c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-12-24 00:05 . 2008-07-24 22:10 118272 —-a-w- c:\windows\system32\hpz3l58a.dll
2009-12-24 00:05 . 2008-07-24 22:09 273920 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzpp58a.dll
2009-12-24 00:02 . 2009-12-24 00:07 150265 —-a-w- c:\windows\hpwins05.dat
2009-12-24 00:01 . 2007-07-05 03:42 1275480 —-a-w- c:\windows\hpzshl01.exe
2009-12-24 00:01 . 2007-07-05 03:42 1132120 —-a-w- c:\windows\hpzmsi01.exe
2009-12-24 00:01 . 2007-09-14 16:11 16050 —-a-w- c:\windows\hpwscr05.dat
2009-12-24 00:01 . 2007-09-14 16:10 4785 —-a-w- c:\windows\hpwmdl05.dat
2009-12-23 23:28 . 2008-05-01 14:33 331776 -c—-w- c:\windows\system32\dllcache\msadce.dll
2009-12-23 23:26 . 2008-06-13 11:05 272128 -c—-w- c:\windows\system32\dllcache\bthport.sys
2009-12-23 23:26 . 2008-05-08 14:02 203136 -c—-w- c:\windows\system32\dllcache\rmcast.sys
2009-12-23 22:40 . 2009-12-23 22:40 ——– d—–w- c:\windows\system32\XPSViewer
2009-12-23 22:40 . 2009-12-24 05:32 ——– d—–w- c:\program files\MSBuild
2009-12-23 22:40 . 2009-12-23 22:40 ——– d—–w- c:\program files\Reference Assemblies
2009-12-23 22:40 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2009-12-23 22:40 . 2008-07-06 12:06 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-12-23 22:40 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2009-12-23 22:40 . 2008-07-06 12:06 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-12-23 22:40 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2009-12-23 22:40 . 2008-07-06 12:06 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2009-12-23 22:40 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2009-12-23 22:40 . 2008-07-06 10:50 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-12-23 22:40 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2009-12-23 22:33 . 2009-12-23 22:33 ——– d—–w- c:\documents and settings\Donald\Application Data\Registry Mechanic
2009-12-23 22:09 . 2009-12-23 22:09 ——– d—–w- c:\documents and settings\Donald\Application Data\URSoft
2009-12-23 22:09 . 2009-12-23 22:12 ——– d—–w- c:\program files\Your Uninstaller 2008
2009-12-23 21:58 . 2009-12-27 03:05 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-12-23 21:58 . 2009-12-23 21:58 ——– d—–w- c:\program files\Common Files\PC Tools
2009-12-23 21:38 . 2009-12-24 05:48 77448 —-a-w- c:\documents and settings\Donald\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-23 21:38 . 2009-12-23 21:38 ——– d—–w- c:\documents and settings\All Users\Application Data\ATI
2009-12-23 21:38 . 2009-12-23 21:38 ——– d—–w- c:\documents and settings\Donald\Local Settings\Application Data\ATI
2009-12-23 21:38 . 2009-12-23 21:38 ——– d—–w- c:\documents and settings\Donald\Application Data\ATI
2009-12-23 21:34 . 2009-12-23 21:34 10134 —-a-r- c:\documents and settings\Donald\Application Data\Microsoft\Installer\{A778A787-08A4-4089-CB68-02A9737DE532}\ARPPRODUCTICON.exe
2009-12-23 21:34 . 2009-12-23 22:46 ——– d—–w- c:\program files\ATI
2009-12-23 21:33 . 2009-12-23 21:33 ——– d—–w- C:\ATI
2009-12-23 21:30 . 2009-12-23 21:30 ——– d—–w- c:\program files\DIFX
2009-12-23 21:23 . 2009-12-27 16:53 ——– d—–w- c:\documents and settings\All Users\Application Data\PCPitstop
2009-12-23 21:23 . 2009-12-23 21:28 ——– d—–w- c:\program files\PCPitstop
2009-12-23 21:20 . 2009-12-23 21:20 ——– d—–w- c:\program files\MRU-Blaster
2009-12-23 21:18 . 2009-12-23 21:18 ——– d—–w- c:\program files\CCleaner
2009-12-23 21:10 . 2009-12-23 21:10 ——– d—–w- c:\windows\system32\scripting
2009-12-23 21:10 . 2009-12-23 21:10 ——– d—–w- c:\windows\l2schemas
2009-12-23 21:10 . 2009-12-23 21:10 ——– d—–w- c:\windows\system32\en
2009-12-23 21:10 . 2009-12-23 21:10 ——– d—–w- c:\windows\system32\bits
2009-12-23 21:08 . 2009-12-23 21:11 ——– d—–w- c:\windows\ServicePackFiles
2009-12-23 21:03 . 2009-12-23 21:03 ——– d—–w- c:\windows\EHome
2009-12-23 20:42 . 2009-08-07 05:24 44768 —-a-w- c:\windows\system32\wups2.dll
2009-12-23 20:24 . 2004-08-04 12:00 4096 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\USMT\iconlib.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-27 21:48 . 2009-12-23 21:15 12708363 —-a-w- c:\windows\Internet Logs\tvDebug.Zip
2009-12-24 02:16 . 2009-12-23 19:26 ——– d—–w- c:\program files\Common Files\InstallShield
2009-12-24 01:43 . 2009-12-24 01:43 ——– d—–w- c:\program files\MSXML 4.0
2009-12-24 00:06 . 2009-12-24 00:04 ——– d—–w- c:\program files\HP
2009-12-23 21:35 . 2009-12-23 19:28 ——– d—–w- c:\program files\ATI Technologies
2009-12-23 21:12 . 2009-12-23 19:20 76487 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-12-23 20:07 . 2009-12-23 20:07 ——– d—–w- c:\documents and settings\Donald\Application Data\CheckPoint
2009-12-23 20:07 . 2009-12-23 20:07 ——– d—–w- c:\program files\CheckPoint
2009-12-23 20:07 . 2009-12-23 20:07 4212 —ha-w- c:\windows\system32\zllictbl.dat
2009-12-23 19:58 . 2009-12-23 19:58 ——– d—–w- c:\program files\ESET
2009-12-23 19:58 . 2009-12-23 19:58 ——– d—–w- c:\documents and settings\All Users\Application Data\ESET
2009-12-23 19:46 . 2009-12-23 19:46 ——– d—–w- c:\program files\ASUS
2009-12-23 19:46 . 2009-12-23 19:28 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-12-23 19:43 . 2009-12-23 19:42 ——– d—–w- c:\program files\VIA
2009-12-23 19:42 . 2009-12-23 19:42 ——– d—–w- c:\program files\AMD
2009-12-23 19:41 . 2009-12-23 19:41 ——– d—–w- c:\documents and settings\Donald\Application Data\InstallShield
2009-12-23 19:33 . 2009-12-23 19:33 0 —-a-w- c:\windows\ativpsrm.bin
2009-12-23 19:32 . 2009-12-23 19:32 ——– d—–w- c:\program files\Common Files\ATI Technologies
2009-12-23 19:20 . 2009-12-23 19:20 ——– d—–w- c:\program files\microsoft frontpage
2009-12-23 19:18 . 2009-12-23 19:18 21640 —-a-w- c:\windows\system32\emptyregdb.dat
2009-11-25 03:50 . 2009-04-29 03:30 4463104 —-a-w- c:\windows\system32\drivers\ati2mtag.sys
2009-11-25 03:27 . 2009-12-23 19:29 446464 —-a-w- c:\windows\system32\ATIDEMGX.dll
2009-11-25 03:26 . 2009-04-29 02:17 300032 —-a-w- c:\windows\system32\ati2dvag.dll
2009-11-25 03:11 . 2009-04-29 02:07 208896 —-a-w- c:\windows\system32\atipdlxx.dll
2009-11-25 03:11 . 2009-04-29 02:06 155648 —-a-w- c:\windows\system32\Oemdspif.dll
2009-11-25 03:10 . 2009-04-29 02:06 26112 —-a-w- c:\windows\system32\Ati2mdxx.exe
2009-11-25 03:10 . 2009-04-29 02:06 43520 —-a-w- c:\windows\system32\ati2edxx.dll
2009-11-25 03:10 . 2009-04-29 02:06 155648 —-a-w- c:\windows\system32\ati2evxx.dll
2009-11-25 03:09 . 2009-04-29 02:04 602112 —-a-w- c:\windows\system32\ati2evxx.exe
2009-11-25 03:07 . 2009-04-29 02:03 53248 —-a-w- c:\windows\system32\ATIDDC.DLL
2009-11-25 02:59 . 2009-12-23 19:29 311296 —-a-w- c:\windows\system32\atiiiexx.dll
2009-11-25 02:59 . 2009-04-29 01:56 3538496 —-a-w- c:\windows\system32\ati3duag.dll
2009-11-25 02:44 . 2009-04-29 01:45 13533184 —-a-w- c:\windows\system32\atioglxx.dll
2009-11-25 02:43 . 2009-04-29 01:42 2142848 —-a-w- c:\windows\system32\ativvaxx.dll
2009-11-25 02:42 . 2009-12-23 19:29 887724 —-a-w- c:\windows\system32\ativva6x.dat
2009-11-25 02:42 . 2009-12-23 19:29 3 —-a-w- c:\windows\system32\ativva5x.dat
2009-11-25 02:26 . 2009-04-29 01:26 65024 —-a-w- c:\windows\system32\atimpc32.dll
2009-11-25 02:26 . 2009-04-29 01:26 65024 —-a-w- c:\windows\system32\amdpcom32.dll
2009-11-25 02:21 . 2009-04-29 01:22 565248 —-a-w- c:\windows\system32\atikvmag.dll
2009-11-25 02:20 . 2009-04-29 01:20 45056 —-a-w- c:\windows\system32\aticalrt.dll
2009-11-25 02:20 . 2009-04-29 01:20 45056 —-a-w- c:\windows\system32\aticalcl.dll
2009-11-25 02:19 . 2009-04-29 01:20 176128 —-a-w- c:\windows\system32\atiadlxx.dll
2009-11-25 02:18 . 2009-04-29 01:19 17408 —-a-w- c:\windows\system32\atitvo32.dll
2009-11-25 02:18 . 2009-04-29 01:18 3612672 —-a-w- c:\windows\system32\aticaldd.dll
2009-11-25 02:18 . 2009-04-29 01:19 53248 —-a-w- c:\windows\system32\drivers\ati2erec.dll
2009-11-25 02:17 . 2009-04-29 01:17 397312 —-a-w- c:\windows\system32\atiok3x2.dll
2009-11-25 02:12 . 2009-04-29 01:13 638976 —-a-w- c:\windows\system32\ati2cqag.dll
2009-11-23 01:42 . 2009-12-23 20:07 1238408 —-a-w- c:\windows\system32\zpeng25.dll
2009-11-23 01:42 . 2009-12-23 20:07 69000 —-a-w- c:\windows\system32\zlcomm.dll
2009-11-23 01:42 . 2009-12-23 20:07 103816 —-a-w- c:\windows\system32\zlcommdb.dll
2009-11-21 15:51 . 2004-08-04 12:00 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-16 19:06 . 2009-11-16 19:06 96408 —-a-w- c:\windows\system32\drivers\epfwtdir.sys
2009-11-16 19:03 . 2009-11-16 19:03 108792 —-a-w- c:\windows\system32\drivers\ehdrv.sys
2009-11-16 18:56 . 2009-11-16 18:56 116520 —-a-w- c:\windows\system32\drivers\eamon.sys
2009-10-29 07:46 . 2004-08-04 12:00 832512 —-a-w- c:\windows\system32\wininet.dll
2009-10-29 07:46 . 2004-08-04 12:00 78336 -c–a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46 . 2004-08-04 12:00 17408 -c–a-w- c:\windows\system32\corpol.dll
2009-10-22 15:59 . 2009-12-23 19:29 196565 —-a-w- c:\windows\system32\atiicdxx.dat
2009-10-21 05:38 . 2004-08-04 12:00 75776 -c–a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 12:00 25088 -c–a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 12:00 265728 -c–a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2004-08-04 12:00 270336 —-a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2004-08-04 12:00 149504 —-a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2004-08-04 12:00 79872 —-a-w- c:\windows\system32\raschap.dll
2009-10-09 00:57 . 2008-07-30 05:59 611328 -c–a-w- c:\windows\system32\uiautomationcore.dll
2009-10-09 00:57 . 2004-08-04 12:00 220160 —-a-w- c:\windows\system32\oleacc.dll
2009-10-09 00:56 . 2004-08-04 12:00 20480 -c–a-w- c:\windows\system32\oleaccrc.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-16 2054360]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-11-23 1037192]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2009-10-26 15872]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-04 00:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Donald^Start Menu^Programs^Startup^MRU-Blaster Silent Clean.lnk]
backup=c:\windows\pss\MRU-Blaster Silent Clean.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2008-06-12 08:43 640376 —-a-w- c:\program files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 21:44 31072 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]
2008-12-31 07:38 33546240 —-a-r- c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2006-12-11 07:52 49152 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]
2009-10-15 01:43 3217368 —-a-w- c:\program files\Registry Mechanic\RegMech.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Six Engine]
2009-01-03 11:19 4067840 —-a-w- c:\program files\ASUS\EPU\EPU.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-11-25 07:24 98304 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2009-12-17 02:26 2002160 —-a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [11/16/2009 9:03 AM 108792]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [11/16/2009 9:06 AM 96408]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [12/16/2009 4:26 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12/16/2009 4:26 PM 74480]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [11/16/2009 9:04 AM 735960]
R2 PCPitstop Scheduling;PCPitstop Scheduling;c:\program files\PCPitstop\PCPitstopScheduleService.exe [12/23/2009 11:23 AM 85504]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [12/23/2009 12:21 PM 583640]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [12/23/2009 9:43 AM 993280]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [12/16/2009 4:27 PM 7408]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.foxnews.com/
IE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-27 12:15
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(720)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(3624)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-12-27 12:16:24
ComboFix-quarantined-files.txt 2009-12-27 22:16
Pre-Run: 314,754,723,840 bytes free
Post-Run: 314,808,987,648 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer
- - End Of File - - E8B72F12B70062336AFF11F2D01F535A
Combofix.txt
ComboFix 09-12-26.05 - Donald 12/27/2009 12:13:39.1.4 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3327.2781 [GMT -10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
((((((((((((((((((((((((( Files Created from 2009-11-27 to 2009-12-27 )))))))))))))))))))))))))))))))
.
2009-12-27 17:35 . 2009-12-27 17:35 ——– d—–w- c:\program files\Trend Micro
2009-12-27 04:25 . 2009-12-04 02:14 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-27 04:25 . 2009-12-04 02:13 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-27 04:25 . 2009-12-27 04:25 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-12-24 20:08 . 2008-04-14 00:12 26624 —-a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-12-24 20:01 . 2009-12-24 20:01 ——– d—–w- c:\documents and settings\Donald\Application Data\Malwarebytes
2009-12-24 20:01 . 2009-12-24 20:01 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-24 18:23 . 2009-12-24 18:23 ——– d—–w- c:\documents and settings\Donald\Application Data\Alien Skin
2009-12-24 17:56 . 2009-12-24 17:56 ——– d—–w- c:\program files\Alien Skin
2009-12-24 07:08 . 2009-12-27 02:49 52224 —-a-w- c:\documents and settings\Donald\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2009-12-24 07:08 . 2009-12-27 02:49 117760 —-a-w- c:\documents and settings\Donald\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-12-24 07:07 . 2009-12-24 07:07 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-12-24 07:07 . 2009-12-24 07:07 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-12-24 07:07 . 2009-12-24 07:07 ——– d—–w- c:\documents and settings\Donald\Application Data\SUPERAntiSpyware.com
2009-12-24 07:07 . 2009-12-24 07:07 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-12-24 07:04 . 2009-12-27 03:04 ——– d—–w- c:\program files\SpywareBlaster
2009-12-24 06:00 . 2009-12-24 06:00 ——– d—–w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-12-24 05:46 . 2009-08-07 05:23 215920 —-a-w- c:\windows\system32\muweb.dll
2009-12-24 05:46 . 2009-08-07 05:23 274288 —-a-w- c:\windows\system32\mucltui.dll
2009-12-24 05:44 . 2008-04-01 07:24 676224 —-a-w- c:\windows\system32\OGACheckControl.dll
2009-12-24 05:33 . 2008-11-10 21:41 32656 —-a-w- c:\windows\system32\msonpmon.dll
2009-12-24 05:33 . 2006-10-27 05:56 33104 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2009-12-24 05:32 . 2009-12-24 06:57 ——– d—–w- c:\program files\Microsoft Works
2009-12-24 05:31 . 2009-12-24 05:31 ——– d—–w- c:\program files\Microsoft.NET
2009-12-24 05:30 . 2009-12-24 05:30 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2009-12-24 05:30 . 2009-12-24 05:32 ——– d—–w- c:\windows\SHELLNEW
2009-12-24 05:29 . 2009-12-24 05:29 ——– d—–w- c:\documents and settings\Donald\Local Settings\Application Data\Microsoft Help
2009-12-24 05:29 . 2009-12-24 06:58 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-24 05:29 . 2009-12-24 05:29 ——– d—–r- C:\MSOCache
2009-12-24 05:25 . 2009-12-24 05:25 323584 —-a-w- c:\windows\system32\AUDIOGENIE2.DLL
2009-12-24 05:23 . 2009-12-24 05:27 ——– d—–w- c:\program files\Replay Music 3
2009-12-24 05:23 . 2009-12-24 05:23 ——– d—–w- c:\windows\Replay Music
2009-12-24 05:08 . 2009-12-24 06:01 ——– d—–w- c:\documents and settings\Donald\Local Settings\Application Data\ApplicationHistory
2009-12-24 04:57 . 2009-12-24 04:57 ——– d—–w- c:\documents and settings\Donald\Local Settings\Application Data\Yahoo
2009-12-24 04:43 . 2009-12-24 04:43 ——– d—–w- c:\documents and settings\Donald\Application Data\Yahoo!
2009-12-24 04:42 . 2009-12-24 04:42 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-12-24 04:42 . 2009-11-11 00:39 607472 —-a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-12-24 04:39 . 2009-12-24 04:42 ——– d—–w- c:\program files\Yahoo!
2009-12-24 04:17 . 2009-12-24 04:17 ——– d—–w- c:\documents and settings\Donald\Application Data\Outertech
2009-12-24 04:14 . 2009-12-24 04:16 ——– d—–w- c:\program files\Get Diz
2009-12-24 03:49 . 2009-06-25 04:24 3734976 —-a-w- c:\windows\system32\drivers\RtKHDMI.sys
2009-12-24 03:49 . 2009-04-01 19:58 1200128 —-a-w- c:\windows\RtkUpd.exe
2009-12-24 03:49 . 2009-04-01 00:15 39936 —-a-w- c:\windows\system32\RHCoInstXP.dll
2009-12-24 03:33 . 2009-12-24 03:33 ——– d—–w- c:\program files\Microsoft Silverlight
2009-12-24 03:32 . 2009-12-24 03:32 ——– d—–w- c:\program files\Windows Media Connect 2
2009-12-24 03:31 . 2009-12-24 03:31 ——– d—–w- c:\windows\system32\drivers\UMDF
2009-12-24 03:31 . 2009-12-24 03:31 ——– d—–w- c:\windows\system32\LogFiles
2009-12-24 03:30 . 2009-12-24 03:30 ——– d—–w- c:\windows\system32\URTTEMP
2009-12-24 03:01 . 2009-12-24 03:01 ——– d—–w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-12-24 02:58 . 2009-12-24 02:58 ——– d—–w- c:\documents and settings\Donald\Local Settings\Application Data\Adobe
2009-12-24 02:50 . 2009-12-24 02:50 ——– d—–w- c:\program files\Common Files\Macrovision Shared
2009-12-24 02:50 . 2008-04-07 15:38 22872 —-a-r- c:\windows\system32\AdobePDFUI.dll
2009-12-24 02:50 . 2008-04-07 15:38 45392 —-a-r- c:\windows\system32\AdobePDF.dll
2009-12-24 02:48 . 2009-12-24 02:50 ——– d—–w- c:\program files\Common Files\Adobe
2009-12-24 02:20 . 2009-12-24 02:20 ——– d—–w- c:\documents and settings\Donald\Application Data\Jasc
2009-12-24 02:17 . 2009-12-24 02:17 ——– d—–w- c:\documents and settings\All Users\Application Data\InstallShield
2009-12-24 02:16 . 2009-12-24 02:16 ——– d—–w- c:\program files\Common Files\Jasc Software Inc
2009-12-24 02:16 . 2009-12-24 02:20 ——– d—–w- c:\program files\Jasc Software Inc
2009-12-24 02:16 . 2009-12-24 02:16 ——– d—–w- c:\documents and settings\Donald\Application Data\Jasc Software Inc
2009-12-24 02:05 . 2009-12-24 02:14 ——– d—–w- c:\program files\Microsoft Picture It! 9
2009-12-24 01:55 . 2009-12-24 01:55 ——– d—–w- c:\program files\Unlocker
2009-12-24 01:54 . 2009-12-24 01:54 ——– d—–w- c:\documents and settings\Donald\Local Settings\Application Data\ESET
2009-12-24 01:38 . 2009-12-26 23:41 ——– d—–w- c:\documents and settings\Donald\Application Data\ieSpell
2009-12-24 01:36 . 2009-12-24 01:36 ——– d—–w- c:\program files\ieSpell
2009-12-24 01:36 . 2009-11-21 15:51 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2009-12-24 01:31 . 2009-06-21 21:44 153088 -c—-w- c:\windows\system32\dllcache\triedit.dll
2009-12-24 01:31 . 2009-07-10 13:27 1315328 -c—-w- c:\windows\system32\dllcache\msoe.dll
2009-12-24 01:27 . 2008-12-11 10:57 333952 -c—-w- c:\windows\system32\dllcache\srv.sys
2009-12-24 01:27 . 2008-10-24 11:21 455296 -c—-w- c:\windows\system32\dllcache\mrxsmb.sys
2009-12-24 01:26 . 2009-07-31 04:35 1172480 -c—-w- c:\windows\system32\dllcache\msxml3.dll
2009-12-24 01:26 . 2008-10-15 16:34 337408 -c—-w- c:\windows\system32\dllcache\netapi32.dll
2009-12-24 00:07 . 2009-12-24 00:07 ——– d—–w- c:\documents and settings\Donald\Application Data\HP
2009-12-24 00:06 . 2009-12-24 00:06 ——– d—–w- c:\documents and settings\All Users\Application Data\HPSSUPPLY
2009-12-24 00:05 . 2009-12-24 00:06 ——– d—–w- c:\documents and settings\All Users\Application Data\HP
2009-12-24 00:05 . 2009-12-24 00:06 ——– d—–w- c:\program files\Common Files\HP
2009-12-24 00:05 . 2009-12-24 00:05 ——– d—–w- c:\program files\Hewlett-Packard
2009-12-24 00:05 . 2009-12-24 00:05 ——– d—–w- c:\program files\Common Files\Hewlett-Packard
2009-12-24 00:05 . 2009-12-24 00:05 ——– d—–w- c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-12-24 00:05 . 2008-07-24 22:10 118272 —-a-w- c:\windows\system32\hpz3l58a.dll
2009-12-24 00:05 . 2008-07-24 22:09 273920 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzpp58a.dll
2009-12-24 00:02 . 2009-12-24 00:07 150265 —-a-w- c:\windows\hpwins05.dat
2009-12-24 00:01 . 2007-07-05 03:42 1275480 —-a-w- c:\windows\hpzshl01.exe
2009-12-24 00:01 . 2007-07-05 03:42 1132120 —-a-w- c:\windows\hpzmsi01.exe
2009-12-24 00:01 . 2007-09-14 16:11 16050 —-a-w- c:\windows\hpwscr05.dat
2009-12-24 00:01 . 2007-09-14 16:10 4785 —-a-w- c:\windows\hpwmdl05.dat
2009-12-23 23:28 . 2008-05-01 14:33 331776 -c—-w- c:\windows\system32\dllcache\msadce.dll
2009-12-23 23:26 . 2008-06-13 11:05 272128 -c—-w- c:\windows\system32\dllcache\bthport.sys
2009-12-23 23:26 . 2008-05-08 14:02 203136 -c—-w- c:\windows\system32\dllcache\rmcast.sys
2009-12-23 22:40 . 2009-12-23 22:40 ——– d—–w- c:\windows\system32\XPSViewer
2009-12-23 22:40 . 2009-12-24 05:32 ——– d—–w- c:\program files\MSBuild
2009-12-23 22:40 . 2009-12-23 22:40 ——– d—–w- c:\program files\Reference Assemblies
2009-12-23 22:40 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2009-12-23 22:40 . 2008-07-06 12:06 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-12-23 22:40 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2009-12-23 22:40 . 2008-07-06 12:06 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-12-23 22:40 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2009-12-23 22:40 . 2008-07-06 12:06 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2009-12-23 22:40 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2009-12-23 22:40 . 2008-07-06 10:50 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-12-23 22:40 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2009-12-23 22:33 . 2009-12-23 22:33 ——– d—–w- c:\documents and settings\Donald\Application Data\Registry Mechanic
2009-12-23 22:09 . 2009-12-23 22:09 ——– d—–w- c:\documents and settings\Donald\Application Data\URSoft
2009-12-23 22:09 . 2009-12-23 22:12 ——– d—–w- c:\program files\Your Uninstaller 2008
2009-12-23 21:58 . 2009-12-27 03:05 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-12-23 21:58 . 2009-12-23 21:58 ——– d—–w- c:\program files\Common Files\PC Tools
2009-12-23 21:38 . 2009-12-24 05:48 77448 —-a-w- c:\documents and settings\Donald\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-23 21:38 . 2009-12-23 21:38 ——– d—–w- c:\documents and settings\All Users\Application Data\ATI
2009-12-23 21:38 . 2009-12-23 21:38 ——– d—–w- c:\documents and settings\Donald\Local Settings\Application Data\ATI
2009-12-23 21:38 . 2009-12-23 21:38 ——– d—–w- c:\documents and settings\Donald\Application Data\ATI
2009-12-23 21:34 . 2009-12-23 21:34 10134 —-a-r- c:\documents and settings\Donald\Application Data\Microsoft\Installer\{A778A787-08A4-4089-CB68-02A9737DE532}\ARPPRODUCTICON.exe
2009-12-23 21:34 . 2009-12-23 22:46 ——– d—–w- c:\program files\ATI
2009-12-23 21:33 . 2009-12-23 21:33 ——– d—–w- C:\ATI
2009-12-23 21:30 . 2009-12-23 21:30 ——– d—–w- c:\program files\DIFX
2009-12-23 21:23 . 2009-12-27 16:53 ——– d—–w- c:\documents and settings\All Users\Application Data\PCPitstop
2009-12-23 21:23 . 2009-12-23 21:28 ——– d—–w- c:\program files\PCPitstop
2009-12-23 21:20 . 2009-12-23 21:20 ——– d—–w- c:\program files\MRU-Blaster
2009-12-23 21:18 . 2009-12-23 21:18 ——– d—–w- c:\program files\CCleaner
2009-12-23 21:10 . 2009-12-23 21:10 ——– d—–w- c:\windows\system32\scripting
2009-12-23 21:10 . 2009-12-23 21:10 ——– d—–w- c:\windows\l2schemas
2009-12-23 21:10 . 2009-12-23 21:10 ——– d—–w- c:\windows\system32\en
2009-12-23 21:10 . 2009-12-23 21:10 ——– d—–w- c:\windows\system32\bits
2009-12-23 21:08 . 2009-12-23 21:11 ——– d—–w- c:\windows\ServicePackFiles
2009-12-23 21:03 . 2009-12-23 21:03 ——– d—–w- c:\windows\EHome
2009-12-23 20:42 . 2009-08-07 05:24 44768 —-a-w- c:\windows\system32\wups2.dll
2009-12-23 20:24 . 2004-08-04 12:00 4096 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\USMT\iconlib.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-27 21:48 . 2009-12-23 21:15 12708363 —-a-w- c:\windows\Internet Logs\tvDebug.Zip
2009-12-24 02:16 . 2009-12-23 19:26 ——– d—–w- c:\program files\Common Files\InstallShield
2009-12-24 01:43 . 2009-12-24 01:43 ——– d—–w- c:\program files\MSXML 4.0
2009-12-24 00:06 . 2009-12-24 00:04 ——– d—–w- c:\program files\HP
2009-12-23 21:35 . 2009-12-23 19:28 ——– d—–w- c:\program files\ATI Technologies
2009-12-23 21:12 . 2009-12-23 19:20 76487 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-12-23 20:07 . 2009-12-23 20:07 ——– d—–w- c:\documents and settings\Donald\Application Data\CheckPoint
2009-12-23 20:07 . 2009-12-23 20:07 ——– d—–w- c:\program files\CheckPoint
2009-12-23 20:07 . 2009-12-23 20:07 4212 —ha-w- c:\windows\system32\zllictbl.dat
2009-12-23 19:58 . 2009-12-23 19:58 ——– d—–w- c:\program files\ESET
2009-12-23 19:58 . 2009-12-23 19:58 ——– d—–w- c:\documents and settings\All Users\Application Data\ESET
2009-12-23 19:46 . 2009-12-23 19:46 ——– d—–w- c:\program files\ASUS
2009-12-23 19:46 . 2009-12-23 19:28 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-12-23 19:43 . 2009-12-23 19:42 ——– d—–w- c:\program files\VIA
2009-12-23 19:42 . 2009-12-23 19:42 ——– d—–w- c:\program files\AMD
2009-12-23 19:41 . 2009-12-23 19:41 ——– d—–w- c:\documents and settings\Donald\Application Data\InstallShield
2009-12-23 19:33 . 2009-12-23 19:33 0 —-a-w- c:\windows\ativpsrm.bin
2009-12-23 19:32 . 2009-12-23 19:32 ——– d—–w- c:\program files\Common Files\ATI Technologies
2009-12-23 19:20 . 2009-12-23 19:20 ——– d—–w- c:\program files\microsoft frontpage
2009-12-23 19:18 . 2009-12-23 19:18 21640 —-a-w- c:\windows\system32\emptyregdb.dat
2009-11-25 03:50 . 2009-04-29 03:30 4463104 —-a-w- c:\windows\system32\drivers\ati2mtag.sys
2009-11-25 03:27 . 2009-12-23 19:29 446464 —-a-w- c:\windows\system32\ATIDEMGX.dll
2009-11-25 03:26 . 2009-04-29 02:17 300032 —-a-w- c:\windows\system32\ati2dvag.dll
2009-11-25 03:11 . 2009-04-29 02:07 208896 —-a-w- c:\windows\system32\atipdlxx.dll
2009-11-25 03:11 . 2009-04-29 02:06 155648 —-a-w- c:\windows\system32\Oemdspif.dll
2009-11-25 03:10 . 2009-04-29 02:06 26112 —-a-w- c:\windows\system32\Ati2mdxx.exe
2009-11-25 03:10 . 2009-04-29 02:06 43520 —-a-w- c:\windows\system32\ati2edxx.dll
2009-11-25 03:10 . 2009-04-29 02:06 155648 —-a-w- c:\windows\system32\ati2evxx.dll
2009-11-25 03:09 . 2009-04-29 02:04 602112 —-a-w- c:\windows\system32\ati2evxx.exe
2009-11-25 03:07 . 2009-04-29 02:03 53248 —-a-w- c:\windows\system32\ATIDDC.DLL
2009-11-25 02:59 . 2009-12-23 19:29 311296 —-a-w- c:\windows\system32\atiiiexx.dll
2009-11-25 02:59 . 2009-04-29 01:56 3538496 —-a-w- c:\windows\system32\ati3duag.dll
2009-11-25 02:44 . 2009-04-29 01:45 13533184 —-a-w- c:\windows\system32\atioglxx.dll
2009-11-25 02:43 . 2009-04-29 01:42 2142848 —-a-w- c:\windows\system32\ativvaxx.dll
2009-11-25 02:42 . 2009-12-23 19:29 887724 —-a-w- c:\windows\system32\ativva6x.dat
2009-11-25 02:42 . 2009-12-23 19:29 3 —-a-w- c:\windows\system32\ativva5x.dat
2009-11-25 02:26 . 2009-04-29 01:26 65024 —-a-w- c:\windows\system32\atimpc32.dll
2009-11-25 02:26 . 2009-04-29 01:26 65024 —-a-w- c:\windows\system32\amdpcom32.dll
2009-11-25 02:21 . 2009-04-29 01:22 565248 —-a-w- c:\windows\system32\atikvmag.dll
2009-11-25 02:20 . 2009-04-29 01:20 45056 —-a-w- c:\windows\system32\aticalrt.dll
2009-11-25 02:20 . 2009-04-29 01:20 45056 —-a-w- c:\windows\system32\aticalcl.dll
2009-11-25 02:19 . 2009-04-29 01:20 176128 —-a-w- c:\windows\system32\atiadlxx.dll
2009-11-25 02:18 . 2009-04-29 01:19 17408 —-a-w- c:\windows\system32\atitvo32.dll
2009-11-25 02:18 . 2009-04-29 01:18 3612672 —-a-w- c:\windows\system32\aticaldd.dll
2009-11-25 02:18 . 2009-04-29 01:19 53248 —-a-w- c:\windows\system32\drivers\ati2erec.dll
2009-11-25 02:17 . 2009-04-29 01:17 397312 —-a-w- c:\windows\system32\atiok3x2.dll
2009-11-25 02:12 . 2009-04-29 01:13 638976 —-a-w- c:\windows\system32\ati2cqag.dll
2009-11-23 01:42 . 2009-12-23 20:07 1238408 —-a-w- c:\windows\system32\zpeng25.dll
2009-11-23 01:42 . 2009-12-23 20:07 69000 —-a-w- c:\windows\system32\zlcomm.dll
2009-11-23 01:42 . 2009-12-23 20:07 103816 —-a-w- c:\windows\system32\zlcommdb.dll
2009-11-21 15:51 . 2004-08-04 12:00 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-16 19:06 . 2009-11-16 19:06 96408 —-a-w- c:\windows\system32\drivers\epfwtdir.sys
2009-11-16 19:03 . 2009-11-16 19:03 108792 —-a-w- c:\windows\system32\drivers\ehdrv.sys
2009-11-16 18:56 . 2009-11-16 18:56 116520 —-a-w- c:\windows\system32\drivers\eamon.sys
2009-10-29 07:46 . 2004-08-04 12:00 832512 —-a-w- c:\windows\system32\wininet.dll
2009-10-29 07:46 . 2004-08-04 12:00 78336 -c–a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46 . 2004-08-04 12:00 17408 -c–a-w- c:\windows\system32\corpol.dll
2009-10-22 15:59 . 2009-12-23 19:29 196565 —-a-w- c:\windows\system32\atiicdxx.dat
2009-10-21 05:38 . 2004-08-04 12:00 75776 -c–a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 12:00 25088 -c–a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 12:00 265728 -c–a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2004-08-04 12:00 270336 —-a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2004-08-04 12:00 149504 —-a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2004-08-04 12:00 79872 —-a-w- c:\windows\system32\raschap.dll
2009-10-09 00:57 . 2008-07-30 05:59 611328 -c–a-w- c:\windows\system32\uiautomationcore.dll
2009-10-09 00:57 . 2004-08-04 12:00 220160 —-a-w- c:\windows\system32\oleacc.dll
2009-10-09 00:56 . 2004-08-04 12:00 20480 -c–a-w- c:\windows\system32\oleaccrc.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-16 2054360]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-11-23 1037192]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2009-10-26 15872]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-04 00:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Donald^Start Menu^Programs^Startup^MRU-Blaster Silent Clean.lnk]
backup=c:\windows\pss\MRU-Blaster Silent Clean.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2008-06-12 08:43 640376 —-a-w- c:\program files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 21:44 31072 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]
2008-12-31 07:38 33546240 —-a-r- c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2006-12-11 07:52 49152 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]
2009-10-15 01:43 3217368 —-a-w- c:\program files\Registry Mechanic\RegMech.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Six Engine]
2009-01-03 11:19 4067840 —-a-w- c:\program files\ASUS\EPU\EPU.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-11-25 07:24 98304 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2009-12-17 02:26 2002160 —-a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [11/16/2009 9:03 AM 108792]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [11/16/2009 9:06 AM 96408]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [12/16/2009 4:26 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12/16/2009 4:26 PM 74480]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [11/16/2009 9:04 AM 735960]
R2 PCPitstop Scheduling;PCPitstop Scheduling;c:\program files\PCPitstop\PCPitstopScheduleService.exe [12/23/2009 11:23 AM 85504]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [12/23/2009 12:21 PM 583640]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [12/23/2009 9:43 AM 993280]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [12/16/2009 4:27 PM 7408]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.foxnews.com/
IE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-27 12:15
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(720)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(3624)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-12-27 12:16:24
ComboFix-quarantined-files.txt 2009-12-27 22:16
Pre-Run: 314,754,723,840 bytes free
Post-Run: 314,808,987,648 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer
- - End Of File - - E8B72F12B70062336AFF11F2D01F535A
