blackdogx
ComboFix 11-05-27.02 - User 28/05/2011 15:34:29.8.4 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.61.1033.18.2038.1462 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\User\Desktop\cfscript.txt
AV: Norton AntiVirus *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
E:\Autorun.inf
.
.
————— FCopy —————
.
c:\windows\system32\dllcache\volsnap.sys –> c:\windows\system32\drivers\volsnap.sys
.
((((((((((((((((((((((((( Files Created from 2011-04-28 to 2011-05-28 )))))))))))))))))))))))))))))))
.
.
2011-05-27 09:18 . 2011-05-27 09:18 ——– d—–w- c:\program files\Common Files\Skype
2011-05-27 09:18 . 2011-05-27 09:18 ——– d—–r- c:\program files\Skype
2011-05-20 06:50 . 2011-05-20 06:50 ——– d—–w- C:\_OTL
2011-05-20 02:51 . 2011-05-20 02:51 ——– d—–w- c:\program files\Common Files\Java
2011-05-20 01:50 . 2011-05-20 01:50 ——– d—–w- c:\program files\Common Files\Adobe AIR
2011-05-19 02:53 . 2011-05-19 02:53 ——– d—–w- c:\program files\ESET
2011-05-17 10:02 . 2011-05-27 09:19 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype Extras
2011-05-09 02:12 . 2010-12-20 08:09 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-09 02:12 . 2010-12-20 08:08 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-05-09 02:12 . 2011-05-09 02:12 ——– d—–w- c:\program files\malcom
2011-05-07 05:37 . 2011-04-13 16:40 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-05-03 02:37 . 2011-05-03 03:23 ——– d—–w- c:\documents and settings\User\Application Data\Norton Utilities
2011-05-02 06:37 . 2011-05-02 06:37 ——– d—–w- c:\documents and settings\User\Application Data\Canneverbe Limited
2011-05-02 06:37 . 2011-05-02 06:37 ——– d—–w- c:\documents and settings\All Users\Application Data\Canneverbe Limited
2011-05-02 06:37 . 2011-05-02 06:37 ——– d—–w- c:\program files\CDBurnerXP
2011-05-02 06:37 . 2009-11-12 03:48 7168 —-a-w- c:\windows\system32\drivers\StarOpen.sys
2011-05-02 06:09 . 2011-05-02 06:09 ——– d—–w- c:\program files\Xilisoft
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-15 00:10 . 2011-04-15 00:10 21460432 —-a-w- c:\program files\15.0.0.122RC5_NUesd_MUI.exe
2011-04-13 19:07 . 2010-04-30 07:57 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-03-07 05:33 . 2009-01-19 04:05 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2008-04-14 12:00 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2008-04-14 12:00 1857920 —-a-w- c:\windows\system32\win32k.sys
2008-04-13 14:10 . 2009-05-26 07:47 96512 —-a-w- c:\program files\atapi.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-05-18_11.08.37 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-05-28 04:57 . 2011-05-28 04:57 16384 c:\windows\Temp\Perflib_Perfdata_e0.dat
+ 2011-05-28 04:59 . 2011-05-28 04:59 16384 c:\windows\Temp\Perflib_Perfdata_188.dat
+ 2011-05-20 01:50 . 2011-05-20 01:50 28160 c:\windows\Installer\97f3cc.msi
+ 2011-05-20 02:50 . 2011-04-13 19:08 157472 c:\windows\system32\javaws.exe
- 2011-05-07 05:37 . 2011-02-02 11:40 157472 c:\windows\system32\javaws.exe
+ 2011-05-20 02:50 . 2011-04-13 19:08 145184 c:\windows\system32\javaw.exe
- 2011-05-07 05:37 . 2011-02-02 11:40 145184 c:\windows\system32\javaw.exe
+ 2011-05-20 02:50 . 2011-04-13 19:08 145184 c:\windows\system32\java.exe
- 2011-05-07 05:37 . 2011-02-02 11:40 145184 c:\windows\system32\java.exe
+ 2011-05-20 02:51 . 2011-05-20 02:51 180224 c:\windows\Installer\97f463.msi
+ 2011-05-27 09:19 . 2011-05-27 09:19 371272 c:\windows\Installer\{5335DADB-34BA-4AE8-A519-648D78498846}\SkypeIcon.exe
- 2011-05-17 10:01 . 2011-05-17 10:01 371272 c:\windows\Installer\{5335DADB-34BA-4AE8-A519-648D78498846}\SkypeIcon.exe
+ 2011-05-27 09:19 . 2011-05-27 09:19 1645056 c:\windows\Installer\a7e833.msi
+ 2011-01-30 20:44 . 2011-01-30 20:44 12425728 c:\windows\Installer\97f3ce.msp
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-03-28 1196936]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-21 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-21 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-21 137752]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2009-10-10 320832]
"dvd43"="c:\program files\dvd43\dvd43_tray.exe" [2009-10-23 827904]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-06-12 127036]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-08-09 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
backup=c:\windows\pss\Acrobat Assistant.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Photo Express Calendar Checker SE.lnk]
backup=c:\windows\pss\Photo Express Calendar Checker SE.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^User^Start Menu^Programs^Startup^OCRAWARE.lnk]
path=c:\documents and settings\User\Start Menu\Programs\Startup\OCRAWARE.lnk
backup=c:\windows\pss\OCRAWARE.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^User^Start Menu^Programs^Startup^PMB Media Check Tool.lnk]
backup=c:\windows\pss\PMB Media Check Tool.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2009-07-27 02:10 1983816 —-a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2009-03-18 01:40 767312 —-a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
2004-12-02 08:23 102400 ——w- c:\program files\Creative\MediaSource\Detector\CTDetect.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox]
2004-01-14 01:10 409600 —-a-w- c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]
2008-04-10 03:36 29757440 —-a-r- c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-13 19:42 1695232 ——w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 01:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PE2CKFNT SE]
1998-07-03 01:51 25088 ——w- c:\program files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-08-09 19:15 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-05-26 11:50 15147400 —-a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-05-17 02:26 39408 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\rmiregistry.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1233:UDP"= 1233:UDP:Windows Media Format SDK (svchost.exe)
"1232:UDP"= 1232:UDP:Windows Media Format SDK (svchost.exe)
.
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1108000.005\symds.sys [24/09/2010 3:14 PM 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1108000.005\symefa.sys [24/09/2010 3:14 PM 173104]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.6.0.32\Definitions\BASHDefs\20110518.001\BHDrvx86.sys [19/05/2011 11:32 AM 802936]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1108000.005\cchpx86.sys [24/09/2010 3:14 PM 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1108000.005\ironx86.sys [24/09/2010 3:14 PM 116784]
R2 DiskDoctorService;Norton Disk Doctor Service;c:\program files\Norton Utilities 15\Tools\Disk Doctor\DiskDoctorSrv.exe [15/04/2011 10:16 AM 1029480]
R2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\17.8.0.5\ccsvchst.exe [24/09/2010 3:14 PM 126392]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [16/05/2011 10:30 AM 105592]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.6.0.32\Definitions\IPSDefs\20110527.001\IDSXpx86.sys [28/05/2011 3:09 PM 341944]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [19/01/2009 2:15 PM 222976]
S2 gupdate1c9d697d19c9338;Google Update Service (gupdate1c9d697d19c9338);c:\program files\Google\Update\GoogleUpdate.exe [17/05/2009 12:32 PM 133104]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\aspi32.sys [21/05/2009 1:21 PM 16512]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\30.tmp –> c:\windows\system32\30.tmp [?]
S3 SymDSMon;SymDSMon;c:\windows\system32\drivers\SymDSMon.sys [15/04/2011 10:16 AM 128248]
S3 SYMSpeedDisk;SYMSpeedDisk;c:\windows\system32\drivers\SymSpeedDisk.sys [15/04/2011 10:16 AM 108800]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [17/05/2009 12:32 PM 133104]
S4 SpeedDiskService;Norton SpeedDisk Service;c:\program files\Norton Utilities 15\Tools\SpeedDisk\SpeedDiskSrv.exe [15/04/2011 10:16 AM 1037672]
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 01:34]
.
2011-05-28 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-17 02:26]
.
2011-05-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-17 02:32]
.
2011-05-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-17 02:32]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.abc.net.au/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
TCP: DhcpNameServer = [removed] [removed]
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-28 15:42
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\NAV]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\17.8.0.5\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\30.tmp"
.
Completion time: 2011-05-28 15:45:42
ComboFix-quarantined-files.txt 2011-05-28 05:45
ComboFix2.txt 2011-05-19 23:22
ComboFix3.txt 2011-05-18 22:10
ComboFix4.txt 2011-05-18 11:11
ComboFix5.txt 2011-05-28 05:33
.
Pre-Run: 155,122,814,976 bytes free
Post-Run: 155,155,947,520 bytes free
.
- - End Of File - - 3C64113DF7CAF49331BF25991A6FB540
Microsoft Windows XP Home Edition 5.1.2600.3.1252.61.1033.18.2038.1462 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\User\Desktop\cfscript.txt
AV: Norton AntiVirus *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
E:\Autorun.inf
.
.
————— FCopy —————
.
c:\windows\system32\dllcache\volsnap.sys –> c:\windows\system32\drivers\volsnap.sys
.
((((((((((((((((((((((((( Files Created from 2011-04-28 to 2011-05-28 )))))))))))))))))))))))))))))))
.
.
2011-05-27 09:18 . 2011-05-27 09:18 ——– d—–w- c:\program files\Common Files\Skype
2011-05-27 09:18 . 2011-05-27 09:18 ——– d—–r- c:\program files\Skype
2011-05-20 06:50 . 2011-05-20 06:50 ——– d—–w- C:\_OTL
2011-05-20 02:51 . 2011-05-20 02:51 ——– d—–w- c:\program files\Common Files\Java
2011-05-20 01:50 . 2011-05-20 01:50 ——– d—–w- c:\program files\Common Files\Adobe AIR
2011-05-19 02:53 . 2011-05-19 02:53 ——– d—–w- c:\program files\ESET
2011-05-17 10:02 . 2011-05-27 09:19 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype Extras
2011-05-09 02:12 . 2010-12-20 08:09 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-09 02:12 . 2010-12-20 08:08 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-05-09 02:12 . 2011-05-09 02:12 ——– d—–w- c:\program files\malcom
2011-05-07 05:37 . 2011-04-13 16:40 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-05-03 02:37 . 2011-05-03 03:23 ——– d—–w- c:\documents and settings\User\Application Data\Norton Utilities
2011-05-02 06:37 . 2011-05-02 06:37 ——– d—–w- c:\documents and settings\User\Application Data\Canneverbe Limited
2011-05-02 06:37 . 2011-05-02 06:37 ——– d—–w- c:\documents and settings\All Users\Application Data\Canneverbe Limited
2011-05-02 06:37 . 2011-05-02 06:37 ——– d—–w- c:\program files\CDBurnerXP
2011-05-02 06:37 . 2009-11-12 03:48 7168 —-a-w- c:\windows\system32\drivers\StarOpen.sys
2011-05-02 06:09 . 2011-05-02 06:09 ——– d—–w- c:\program files\Xilisoft
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-15 00:10 . 2011-04-15 00:10 21460432 —-a-w- c:\program files\15.0.0.122RC5_NUesd_MUI.exe
2011-04-13 19:07 . 2010-04-30 07:57 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-03-07 05:33 . 2009-01-19 04:05 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2008-04-14 12:00 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2008-04-14 12:00 1857920 —-a-w- c:\windows\system32\win32k.sys
2008-04-13 14:10 . 2009-05-26 07:47 96512 —-a-w- c:\program files\atapi.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-05-18_11.08.37 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-05-28 04:57 . 2011-05-28 04:57 16384 c:\windows\Temp\Perflib_Perfdata_e0.dat
+ 2011-05-28 04:59 . 2011-05-28 04:59 16384 c:\windows\Temp\Perflib_Perfdata_188.dat
+ 2011-05-20 01:50 . 2011-05-20 01:50 28160 c:\windows\Installer\97f3cc.msi
+ 2011-05-20 02:50 . 2011-04-13 19:08 157472 c:\windows\system32\javaws.exe
- 2011-05-07 05:37 . 2011-02-02 11:40 157472 c:\windows\system32\javaws.exe
+ 2011-05-20 02:50 . 2011-04-13 19:08 145184 c:\windows\system32\javaw.exe
- 2011-05-07 05:37 . 2011-02-02 11:40 145184 c:\windows\system32\javaw.exe
+ 2011-05-20 02:50 . 2011-04-13 19:08 145184 c:\windows\system32\java.exe
- 2011-05-07 05:37 . 2011-02-02 11:40 145184 c:\windows\system32\java.exe
+ 2011-05-20 02:51 . 2011-05-20 02:51 180224 c:\windows\Installer\97f463.msi
+ 2011-05-27 09:19 . 2011-05-27 09:19 371272 c:\windows\Installer\{5335DADB-34BA-4AE8-A519-648D78498846}\SkypeIcon.exe
- 2011-05-17 10:01 . 2011-05-17 10:01 371272 c:\windows\Installer\{5335DADB-34BA-4AE8-A519-648D78498846}\SkypeIcon.exe
+ 2011-05-27 09:19 . 2011-05-27 09:19 1645056 c:\windows\Installer\a7e833.msi
+ 2011-01-30 20:44 . 2011-01-30 20:44 12425728 c:\windows\Installer\97f3ce.msp
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-03-28 1196936]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-21 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-21 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-21 137752]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2009-10-10 320832]
"dvd43"="c:\program files\dvd43\dvd43_tray.exe" [2009-10-23 827904]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-06-12 127036]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-08-09 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
backup=c:\windows\pss\Acrobat Assistant.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Photo Express Calendar Checker SE.lnk]
backup=c:\windows\pss\Photo Express Calendar Checker SE.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^User^Start Menu^Programs^Startup^OCRAWARE.lnk]
path=c:\documents and settings\User\Start Menu\Programs\Startup\OCRAWARE.lnk
backup=c:\windows\pss\OCRAWARE.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^User^Start Menu^Programs^Startup^PMB Media Check Tool.lnk]
backup=c:\windows\pss\PMB Media Check Tool.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2009-07-27 02:10 1983816 —-a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2009-03-18 01:40 767312 —-a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
2004-12-02 08:23 102400 ——w- c:\program files\Creative\MediaSource\Detector\CTDetect.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox]
2004-01-14 01:10 409600 —-a-w- c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]
2008-04-10 03:36 29757440 —-a-r- c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-13 19:42 1695232 ——w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 01:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PE2CKFNT SE]
1998-07-03 01:51 25088 ——w- c:\program files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-08-09 19:15 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-05-26 11:50 15147400 —-a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-05-17 02:26 39408 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\rmiregistry.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1233:UDP"= 1233:UDP:Windows Media Format SDK (svchost.exe)
"1232:UDP"= 1232:UDP:Windows Media Format SDK (svchost.exe)
.
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1108000.005\symds.sys [24/09/2010 3:14 PM 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1108000.005\symefa.sys [24/09/2010 3:14 PM 173104]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.6.0.32\Definitions\BASHDefs\20110518.001\BHDrvx86.sys [19/05/2011 11:32 AM 802936]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1108000.005\cchpx86.sys [24/09/2010 3:14 PM 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1108000.005\ironx86.sys [24/09/2010 3:14 PM 116784]
R2 DiskDoctorService;Norton Disk Doctor Service;c:\program files\Norton Utilities 15\Tools\Disk Doctor\DiskDoctorSrv.exe [15/04/2011 10:16 AM 1029480]
R2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\17.8.0.5\ccsvchst.exe [24/09/2010 3:14 PM 126392]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [16/05/2011 10:30 AM 105592]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.6.0.32\Definitions\IPSDefs\20110527.001\IDSXpx86.sys [28/05/2011 3:09 PM 341944]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [19/01/2009 2:15 PM 222976]
S2 gupdate1c9d697d19c9338;Google Update Service (gupdate1c9d697d19c9338);c:\program files\Google\Update\GoogleUpdate.exe [17/05/2009 12:32 PM 133104]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\aspi32.sys [21/05/2009 1:21 PM 16512]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\30.tmp –> c:\windows\system32\30.tmp [?]
S3 SymDSMon;SymDSMon;c:\windows\system32\drivers\SymDSMon.sys [15/04/2011 10:16 AM 128248]
S3 SYMSpeedDisk;SYMSpeedDisk;c:\windows\system32\drivers\SymSpeedDisk.sys [15/04/2011 10:16 AM 108800]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [17/05/2009 12:32 PM 133104]
S4 SpeedDiskService;Norton SpeedDisk Service;c:\program files\Norton Utilities 15\Tools\SpeedDisk\SpeedDiskSrv.exe [15/04/2011 10:16 AM 1037672]
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 01:34]
.
2011-05-28 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-17 02:26]
.
2011-05-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-17 02:32]
.
2011-05-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-17 02:32]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.abc.net.au/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
TCP: DhcpNameServer = [removed] [removed]
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-28 15:42
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\NAV]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\17.8.0.5\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\30.tmp"
.
Completion time: 2011-05-28 15:45:42
ComboFix-quarantined-files.txt 2011-05-28 05:45
ComboFix2.txt 2011-05-19 23:22
ComboFix3.txt 2011-05-18 22:10
ComboFix4.txt 2011-05-18 11:11
ComboFix5.txt 2011-05-28 05:33
.
Pre-Run: 155,122,814,976 bytes free
Post-Run: 155,155,947,520 bytes free
.
- - End Of File - - 3C64113DF7CAF49331BF25991A6FB540