"Dad" - 2007-06-23 10:17:45 Service Pack 2 NTFS
ComboFix 07-06-3B - Running from: "C:\Documents and Settings\Dad\Desktop\"
((((((((((((((((((((((((( Files Created from 2007-05-23 to 2007-06-23 )))))))))))))))))))))))))))))))
2007-06-23 10:11 d——– C:\WINDOWS\LastGood
2007-06-14 21:50 d——– C:\DOCUME~1\Dad\APPLIC~1\VariCAD
2007-06-14 21:49 d——– C:\Program Files\VariCAD
2007-06-14 21:33 154,624 –a—— C:\WINDOWS\system32\glut32.dll
2007-06-14 21:33 d——– C:\Program Files\DesignCAD 3D MAX Plus
2007-06-13 18:25 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-06-13 18:25 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-06-11 21:21 49,152 –a—— C:\WINDOWS\nircmd.exe
2007-06-09 10:35 d——– C:\!KillBox
2007-06-06 18:06 d——– C:\VundoFix Backups
2007-05-30 18:34 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-05-30 18:26 d——– C:\Program Files\Eusing Free Registry Cleaner
2007-05-26 17:53 d——– C:\Program Files\Track Eraser Deluxe
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-06-17 05:58:33 ——– d—–w C:\DOCUME~1\Dad\APPLIC~1\Skype
2007-06-15 04:49:29 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-06-09 19:11:20 ——– d—–w C:\Program Files\InterActual
2007-05-31 01:35:57 ——– d—–w C:\DOCUME~1\Dad\APPLIC~1\Lavasoft
2007-05-31 01:35:24 ——– d—–w C:\Program Files\Lavasoft
2007-05-16 15:12:02 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-09 10:11:23 ——– d—–w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-05-04 00:18:03 ——– d—–w C:\Program Files\Common Files\Broderbund
2007-04-27 00:51:49 104,646 —-a-w C:\WINDOWS\hpoins04.dat
2007-04-25 14:21:15 144,896 —-a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23 2,854,400 —-a-w C:\WINDOWS\system32\msi.dll
2007-04-17 05:47:36 33,624 —-a-w C:\WINDOWS\system32\wups.dll
2007-04-17 05:45:54 1,710,936 —-a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 05:45:48 549,720 —-a-w C:\WINDOWS\system32\wuapi.dll
2007-04-17 05:45:42 325,976 —-a-w C:\WINDOWS\system32\wucltui.dll
2007-04-17 05:45:36 203,096 —-a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 05:45:28 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 05:45:20 53,080 —-a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 05:45:20 43,352 —-a-w C:\WINDOWS\system32\wups2.dll
2007-04-17 05:44:20 271,224 —-a-w C:\WINDOWS\system32\mucltui.dll
2007-04-17 05:44:18 208,248 —-a-w C:\WINDOWS\system32\muweb.dll
2007-03-24 21:00:23 17,408 —-a-w C:\psapi.dll
2007-03-23 13:07:56 1,683,280 ——w C:\WINDOWS\system32\XpsSvcs.dll
2007-03-23 13:07:54 583,504 ——w C:\WINDOWS\system32\XPSSHHDR.dll
2007-03-23 03:25:02 124,928 ——w C:\WINDOWS\system32\prntvpt.dll
2005-04-26 07:25:10 104 –sh–r C:\WINDOWS\system32\2E6684E5B4.sys
2005-04-26 07:27:39 4,184 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2004-12-10 12:57]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2005-12-04 16:39]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 14:54]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41]
"ATIPTA"="atiptaxx.exe" [2002-05-17 16:52 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"ATI Launchpad"="C:\Program Files\ATI Multimedia\main\launchpd.exe" [2002-05-02 10:57]
"ATI Remote Control"="C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe" [2002-06-04 15:39]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
backup=C:\WINDOWS\pss\Microsoft Works Calendar Reminders.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NkbMonitor.exe.lnk]
backup=C:\WINDOWS\pss\NkbMonitor.exe.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
mHotkey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative MediaSource Go]
C:\Program Files\Creative\MediaSource\GO\CTCMSGo.exe /SCB
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDET]
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
CTHELPER.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeadAIM]
rundll32.exe "C:\PROGRA~1\AIM95\\DeadAIM.ocm",ExportedCheckODLs
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GWMDMMSG]
GWMDMMSG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GWMDMpi]
C:\WINDOWS\GWMDMpi.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Program Files\ahead\InCD\InCD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteCenter]
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SBDrvDet]
C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
C:\WINDOWS\UpdReg.EXE
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ba17d7e-cab9-11db-80ee-0007e9af295f}]
AutoRun\command- F:\LaunchU3.exe
*Newly Created Service* - NMSCFG
Contents of the 'Scheduled Tasks' folder
2007-06-23 17:19:00 C:\WINDOWS\tasks\Symantec NetDetect.job
**************************************************************************
catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-06-23 10:20:57
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
**************************************************************************
Completion time: 2007-06-23 10:21:56
C:\ComboFix-quarantined-files.txt … 2007-06-23 10:21
C:\ComboFix2.txt … 2007-06-20 19:14
C:\ComboFix3.txt … 2007-06-14 06:56
— E O F —