trj/ci.a generic malware

heres cobo log

ComboFix 11-07-07.03 - Paul 07/07/2011 18:25:16.3.2 - x86
Microsoft® Windows Vista™ Business 6.0.6002.2.1252.44.1033.18.3036.2046 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Paul\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
FILE ::
"c:\windows\system32\config\systemprofile\cdiygtjw.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_MICORSOFT_WINDOWS_SERVICE
.
.
((((((((((((((((((((((((( Files Created from 2011-06-07 to 2011-07-07 )))))))))))))))))))))))))))))))
.
.
2011-07-07 17:28 . 2011-07-07 17:28 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-07-07 17:24 . 2011-07-07 17:24 ——– d—–w- C:\32788R22FWJFW
2011-07-07 08:21 . 2011-07-07 10:14 ——– d—–w- c:\users\Paul\DoctorWeb
2011-07-07 07:32 . 2011-07-07 10:33 36864 —-atw- c:\windows\system32\config\systemprofile\~DFDEB6.tmp
2011-07-07 07:32 . 2011-07-07 07:32 0 —-atw- c:\windows\system32\config\systemprofile\~DF5CEA.tmp
2011-07-05 21:55 . 2011-07-05 21:55 ——– d—–w- c:\program files\ESET
2011-07-05 14:57 . 2011-07-07 17:29 ——– d—–w- c:\users\Paul\AppData\Local\temp
2011-07-05 12:14 . 2011-07-05 12:14 ——– d—–w- c:\program files\GIANT Company Software
2011-07-05 12:13 . 2011-07-05 12:13 ——– d—–w- c:\windows\Downloaded Installations
2011-07-05 08:42 . 2011-05-29 08:11 39984 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-05 08:42 . 2011-07-05 08:42 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-07-05 08:42 . 2011-05-29 08:11 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-07-05 07:44 . 2011-06-07 15:55 7074640 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{51684DF5-0DF8-4D60-BB7B-06C9BF5A3353}\mpengine.dll
2011-07-04 21:00 . 2011-07-04 21:00 ——– d—–w- C:\_OTL
2011-07-04 17:32 . 2011-07-04 17:32 ——– d-sh–w- c:\windows\system32\%APPDATA%
2011-07-04 14:42 . 2010-05-26 09:45 18816 ——w- c:\windows\system32\SAVRKBootTasks.sys
2011-07-04 11:09 . 2011-07-04 16:46 ——– d—–w- c:\program files\Spybot - Search & Destroy
2011-07-04 11:09 . 2011-07-04 12:02 ——– d—–w- c:\programdata\Spybot - Search & Destroy
2011-07-04 09:55 . 2011-07-04 09:55 ——– d—–w- c:\program files\Trend Micro
2011-07-04 09:54 . 2011-07-04 09:54 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-03 17:25 . 2011-07-04 16:43 ——– d—–w- c:\programdata\Lavasoft
2011-07-03 17:25 . 2011-07-03 17:25 ——– d—–w- c:\program files\Lavasoft
2011-07-03 17:22 . 2011-07-03 17:22 ——– d—–w- c:\windows\system32\config\systemprofile\Google Toolbar
2011-07-03 17:22 . 2011-07-03 17:22 ——– d—–w- c:\windows\system32\config\systemprofile\Low
2011-06-29 19:38 . 2011-06-29 19:38 ——– d—–w- c:\users\Paul\AppData\Roaming\Malwarebytes
2011-06-29 06:50 . 2011-06-29 06:50 ——– d—–w- c:\program files\Sophos
2011-06-29 06:46 . 2011-04-29 15:59 276992 —-a-w- c:\windows\system32\schannel.dll
2011-06-29 06:43 . 2011-06-29 06:43 ——– d—–w- c:\users\Paul\AppData\Local\{C8DDA1F2-1573-4419-B26B-9D47B513CB24}
2011-06-24 13:58 . 2011-06-29 17:34 ——– d—–w- c:\programdata\Viewpoint
2011-06-24 11:58 . 2011-06-24 11:58 ——– d—–w- c:\users\Paul\AppData\Local\{1AB82F8B-455E-4E4E-82F6-130F833B3D04}
2011-06-23 13:40 . 2011-06-23 13:40 ——– d—–w- c:\program files\Common Files\Adobe
2011-06-23 11:13 . 2011-06-23 11:13 ——– d—–w- c:\program files\Common Files\Java
2011-06-23 11:13 . 2011-05-04 03:52 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-06-23 08:03 . 2011-06-23 08:03 ——– d—–w- c:\users\Paul\AppData\Local\{0C1184A4-F776-4750-8482-9C77BEEFFDB2}
2011-06-22 12:49 . 2011-06-22 12:49 ——– d—–w- c:\programdata\Malwarebytes
2011-06-22 09:52 . 2011-07-05 08:24 ——– d—–w- c:\programdata\ParetoLogic
2011-06-22 07:56 . 2011-06-22 07:57 ——– d—–w- c:\users\Paul\AppData\Local\{EE615C3A-1A8C-43EF-8D39-E41CD99460DC}
2011-06-21 07:48 . 2011-06-21 07:49 ——– d—–w- c:\users\Paul\AppData\Local\{B81A3A10-1C42-49C0-B458-9CA7220E7429}
2011-06-20 07:57 . 2011-06-20 07:58 ——– d—–w- c:\users\Paul\AppData\Local\{A6A8EE67-B008-4411-ABC2-E6A95520B843}
2011-06-17 07:52 . 2011-06-17 07:53 ——– d—–w- c:\users\Paul\AppData\Local\{054A9C43-7396-4AE9-8932-081365B35620}
2011-06-16 07:50 . 2011-06-16 07:51 ——– d—–w- c:\users\Paul\AppData\Local\{FB2A2C19-5107-44D8-A0CC-00E8A9B97140}
2011-06-15 16:10 . 2011-04-25 15:29 141104 —-a-w- c:\program files\Internet Explorer\sqmapi.dll
2011-06-15 16:10 . 2011-04-22 23:25 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2011-06-15 16:10 . 2011-04-22 23:35 1797632 —-a-w- c:\windows\system32\jscript9.dll
2011-06-15 08:03 . 2011-04-14 14:59 75264 —-a-w- c:\windows\system32\drivers\dfsc.sys
2011-06-15 08:02 . 2011-04-21 13:58 273408 —-a-w- c:\windows\system32\drivers\afd.sys
2011-06-15 08:02 . 2011-04-29 13:25 146432 —-a-w- c:\windows\system32\drivers\srv2.sys
2011-06-15 08:02 . 2011-04-29 13:25 102400 —-a-w- c:\windows\system32\drivers\srvnet.sys
2011-06-15 08:02 . 2010-12-20 16:35 563712 —-a-w- c:\windows\system32\oleaut32.dll
2011-06-15 08:02 . 2011-05-02 17:16 739328 —-a-w- c:\windows\system32\inetcomm.dll
2011-06-15 08:02 . 2011-05-02 12:02 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-06-15 08:02 . 2011-04-29 13:24 214016 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-15 08:02 . 2011-04-29 13:24 79872 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-06-15 08:02 . 2011-04-29 13:24 106496 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-06-15 07:55 . 2011-06-15 07:55 ——– d—–w- c:\users\Paul\AppData\Local\{04DC7D24-F86C-41CE-9996-14CACAF9B390}
2011-06-14 08:00 . 2011-06-14 08:01 ——– d—–w- c:\users\Paul\AppData\Local\{EBA4DA58-C65D-4AB7-AC11-038B6BB79233}
2011-06-13 07:55 . 2011-06-13 07:55 ——– d—–w- c:\users\Paul\AppData\Local\{3D151075-E4C9-44BC-AC01-2671C22E5B97}
2011-06-10 07:32 . 2011-06-10 07:33 ——– d—–w- c:\users\Paul\AppData\Local\{8C7F33F3-5B56-45A8-A718-E6942839888F}
2011-06-09 16:03 . 2011-06-09 16:03 ——– d—–w- c:\program files\MSXML 4.0
2011-06-09 09:14 . 2011-06-09 09:14 ——– d—–w- c:\programdata\NokiaAccount
2011-06-09 08:58 . 2009-07-14 17:45 445008 —-a-w- c:\windows\system32\drivers\Wdf01000.sys
2011-06-09 08:58 . 2009-07-14 17:45 38480 —-a-w- c:\windows\system32\drivers\WdfLdr.sys
2011-06-09 08:53 . 2011-06-09 09:24 ——– d—–w- c:\users\Paul\AppData\Local\Nokia
2011-06-09 08:53 . 2011-06-22 23:59 ——– d—–w- c:\programdata\PC Suite
2011-06-09 08:53 . 2011-06-09 09:16 ——– d—–w- c:\users\Paul\AppData\Roaming\PC Suite
2011-06-09 08:51 . 2011-06-09 08:51 ——– d—–w- c:\program files\Common Files\Nokia
2011-06-09 08:51 . 2011-06-09 08:51 ——– d—–w- c:\program files\DIFX
2011-06-09 08:51 . 2008-08-26 09:26 18816 —-a-w- c:\windows\system32\drivers\pccsmcfd.sys
2011-06-09 08:50 . 2011-06-09 08:50 ——– d—–w- c:\program files\PC Connectivity Solution
2011-06-09 08:49 . 2010-12-02 14:13 75264 —-a-w- c:\windows\system32\nmwcdcls.dll
2011-06-09 08:49 . 2011-06-22 23:59 ——– d—–w- c:\programdata\NokiaInstallerCache
2011-06-09 08:49 . 2011-06-09 08:51 ——– d—–w- c:\program files\Nokia
2011-06-09 07:58 . 2011-06-09 07:58 ——– d—–w- c:\users\Paul\AppData\Local\{19427B42-C493-4EC0-8CDC-2893A6FAE861}
2011-06-08 07:31 . 2011-06-08 07:31 ——– d—–w- c:\users\Paul\AppData\Local\{5B75D84C-5465-4B2E-982E-5831DE0762DE}
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-24 08:03 . 2010-02-24 11:56 848 –sha-w- c:\programdata\KGyGaAvL.sys
2011-05-24 18:14 . 2010-06-11 11:18 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-05-24 08:03 . 2011-05-24 08:03 161792 —-a-w- c:\windows\system32\msls31.dll
2011-05-24 08:03 . 2011-05-24 08:03 1126912 —-a-w- c:\windows\system32\wininet.dll
2011-05-24 08:03 . 2011-05-24 08:03 86528 —-a-w- c:\windows\system32\iesysprep.dll
2011-05-24 08:03 . 2011-05-24 08:03 76800 —-a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-05-24 08:03 . 2011-05-24 08:03 74752 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-05-24 08:03 . 2011-05-24 08:03 63488 —-a-w- c:\windows\system32\tdc.ocx
2011-05-24 08:03 . 2011-05-24 08:03 48640 —-a-w- c:\windows\system32\mshtmler.dll
2011-05-24 08:03 . 2011-05-24 08:03 367104 —-a-w- c:\windows\system32\html.iec
2011-05-24 08:03 . 2011-05-24 08:03 74752 —-a-w- c:\windows\system32\iesetup.dll
2011-05-24 08:03 . 2011-05-24 08:03 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-05-24 08:03 . 2011-05-24 08:03 23552 —-a-w- c:\windows\system32\licmgr10.dll
2011-05-24 08:03 . 2011-05-24 08:03 152064 —-a-w- c:\windows\system32\wextract.exe
2011-05-24 08:03 . 2011-05-24 08:03 150528 —-a-w- c:\windows\system32\iexpress.exe
2011-05-24 08:03 . 2011-05-24 08:03 142848 —-a-w- c:\windows\system32\ieUnatt.exe
2011-05-24 08:03 . 2011-05-24 08:03 1427456 —-a-w- c:\windows\system32\inetcpl.cpl
2011-05-24 08:03 . 2011-05-24 08:03 11776 —-a-w- c:\windows\system32\mshta.exe
2011-05-24 08:03 . 2011-05-24 08:03 101888 —-a-w- c:\windows\system32\admparse.dll
2011-05-24 08:03 . 2011-05-24 08:03 35840 —-a-w- c:\windows\system32\imgutil.dll
2011-05-24 08:03 . 2011-05-24 08:03 110592 —-a-w- c:\windows\system32\IEAdvpack.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-05-23 128296]
"D066UUtility"="c:\windows\TWAIN_32\D66U\D066UUTY.EXE" [2000-07-06 32768]
"DLPSP"="c:\program files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE" [2009-07-08 406840]
"DLUPDR"="c:\program files\Dell Printers\Additional Color Laser Software\Updater\DLUPDR.EXE" [2009-07-08 243008]
"DLQLU"="c:\program files\Dell Printers\Additional Color Laser Software\Launcher\DLQLU.EXE" [2009-07-08 816368]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 136216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 171032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 170520]
"RtHDVCpl"="RtHDVCpl.exe" [2008-08-19 6265376]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 11:55 937920 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-06 11:55 35736 —-a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel File Shell Monitor]
2008-08-08 17:30 16712 —-a-r- c:\program files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]
2008-08-08 17:30 532808 —-a-r- c:\program files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-09-24 02:10 421160 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-11-10 01:54 4240760 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
2011-05-20 15:56 724536 —-a-w- c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-09-08 10:17 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1c9c7fdbc428860;Google Update Service (gupdate1c9c7fdbc428860);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-28 133104]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-28 133104]
R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\DD63.tmp [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S1 SAVRKBootTasks;Boot Tasks Driver;c:\windows\system32\SAVRKBootTasks.sys [2010-05-26 18816]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AERTFilters;Andrea RT Filters Service;c:\windows\system32\AERTSrv.exe [2008-08-19 81920]
S2 DLSDB;Dell Printer Status Database;c:\program files\Dell Printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE [2006-12-07 140184]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [2008-08-19 27648]
S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-08-26 112128]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-28 12:34]
.
2011-07-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-28 12:34]
.
2011-07-07 c:\windows\Tasks\RtlNICDiagVistaStart.job
- c:\program files\Realtek\RTNICDiag\RTNICDiag.exe [2009-04-16 07:02]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
TCP: DhcpNameServer = 192.168.1.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-07 18:29
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\DD63.tmp"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,94,bd,0c,6b,ab,e1,5f,46,89,f4,cd,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,94,bd,0c,6b,ab,e1,5f,46,89,f4,cd,\
.
———————— Other Running Processes ————————
.
c:\program files\Google\Update\1.3.21.57\GoogleCrashHandler.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\conime.exe
c:\windows\RtHDVCpl.exe
c:\windows\PEV.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Completion time: 2011-07-07 18:34:07 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-07 17:34
ComboFix2.txt 2011-07-05 21:41
ComboFix3.txt 2011-07-05 14:57
.
Pre-Run: 257,598,906,368 bytes free
Post-Run: 257,596,039,168 bytes free
.
- - End Of File - - 3022EB3D10F715413FA6151CBE90E0AC