ussoace
as you have requested…
ComboFix 07-11-01.1** - Kev 2007-11-01 21:23:03.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.436 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Local Settings\Temporary Internet Files\Content.IE5\7SLRBDSN\ComboFix[1].exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Kev\Desktop\internet.lnk
C:\WINDOWS\hosts
C:\WINDOWS\system32\drivers\sfsync02.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
——-\LEGACY_SFSYNC02
——-\sfsync02
((((((((((((((((((((((((( Files Created from 2007-10-02 to 2007-11-02 )))))))))))))))))))))))))))))))
.
2007-11-01 21:20 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-10-31 21:58 d——– C:\Documents and Settings\Kev\Application Data\Grisoft
2007-10-31 21:58 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2007-10-31 21:58 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-10-31 17:34 3,524 –a—— C:\WINDOWS\system32\tmp.reg
2007-10-31 17:33 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2007-10-31 17:33 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2007-10-31 17:33 53,248 –a—— C:\WINDOWS\system32\Process.exe
2007-10-31 17:33 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2007-10-31 17:33 25,600 –a—— C:\WINDOWS\system32\WS2Fix.exe
2007-10-28 10:56 d——– C:\Program Files\Spyware Doctor
2007-10-28 10:56 d——– C:\Documents and Settings\Kev\Application Data\PC Tools
2007-10-28 10:56 83,536 –a—— C:\WINDOWS\system32\drivers\iksyssec.sys
2007-10-28 10:56 59,984 –a—— C:\WINDOWS\system32\drivers\iksysflt.sys
2007-10-28 10:56 52,304 –a—— C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-10-28 10:56 39,248 –a—— C:\WINDOWS\system32\drivers\ikfileflt.sys
2007-10-28 10:56 26,064 –a—— C:\WINDOWS\system32\drivers\kcom.sys
2007-10-28 10:11 63 –a—— C:\WINDOWS\system\SysSD.dll
2007-10-28 10:03 d——– C:\Program Files\Enigma Software Group
2007-10-27 15:30 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-27 15:16 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-10-27 13:48 d——– C:\Program Files\Symantec
2007-10-27 12:04 d——– C:\Program Files\McAfee.com
2007-10-27 12:04 348,160 –a—— C:\WINDOWS\system32\mcinsctl.dll
2007-10-27 12:04 270,336 –a—— C:\WINDOWS\system32\mcgdmgr.dll
2007-10-27 00:49 d——– C:\Documents and Settings\All Users\Application Data\McAfee
2007-10-27 00:12 d——– C:\WINDOWS\Sun
2007-10-26 23:48 d——– C:\Documents and Settings\All Users\Application Data\Symantec
2007-10-26 23:45 d——– C:\Program Files\Common Files\Symantec Shared
2007-10-26 23:38 d——– C:\Program Files\MagicDisc
2007-10-26 23:38 92,544 –a—— C:\WINDOWS\system32\drivers\mcdbus.sys
2007-10-26 23:32 d——– C:\Program Files\MagicISO
2007-10-26 23:10 d——– C:\Program Files\EZVideo
2007-10-26 23:10 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2007-10-26 16:36 d——– C:\Program Files\Alwil Software
2007-10-24 21:44 103,736 –a—— C:\WINDOWS\system32\PnkBstrB.exe
2007-10-24 21:44 66,872 –a—— C:\WINDOWS\system32\PnkBstrA.exe
2007-10-24 21:44 22,328 –a—— C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-10-24 20:51 236,824 –a—— C:\WINDOWS\system32\xactengine2_3.dll
2007-10-24 20:51 62,744 –a—— C:\WINDOWS\system32\xinput1_2.dll
2007-10-24 20:50 d——– C:\Program Files\America's Army Server Manager
2007-10-24 20:46 d——– C:\Program Files\America's Army
2007-10-24 16:32 163,840 –a—— C:\WINDOWS\system32\PrfAct.exe
2007-10-24 16:32 147,456 –a—— C:\WINDOWS\system32\SAICFG.dll
2007-10-24 16:32 122,880 –a—— C:\WINDOWS\system32\Nx.exe
2007-10-24 16:32 45,056 –a—— C:\WINDOWS\system32\SAIHOOK.dll
2007-10-24 16:32 40,960 –a—— C:\WINDOWS\system32\REnum.exe
2007-10-24 16:32 26,752 –a—— C:\WINDOWS\system32\drivers\SaiNtBus.sys
2007-10-24 16:32 15,616 –a—— C:\WINDOWS\system32\drivers\SaiMini.sys
2007-10-24 16:31 d——– C:\Program Files\Saitek
2007-10-24 16:31 102,400 –a—— C:\WINDOWS\system32\atl70.dll
2007-10-24 15:33 d——– C:\Documents and Settings\Kev\Application Data\vlc
2007-10-24 15:32 d——– C:\Program Files\VideoLAN
2007-10-23 22:12 d——– C:\Documents and Settings\All Users\Application Data\Saitek
2007-10-23 18:38 155,648 –a—— C:\WINDOWS\system32\nY.exe
2007-10-23 18:38 57,344 –a—— C:\WINDOWS\system32\SAIGON.dll
2007-10-23 18:38 45,056 –a—— C:\WINDOWS\system32\SAIKICK.dll
2007-10-22 21:33 d——– C:\Program Files\Common Files\Adobe
2007-10-20 12:03 d——– C:\Program Files\Microsoft Games
2007-10-14 11:24 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-10-09 21:46 d——– C:\Program Files\LoMan
2007-10-04 16:11 d——– C:\Documents and Settings\Kev\Application Data\Ahead
2007-10-04 16:10 d——– C:\Program Files\Nero
2007-10-04 16:10 d——– C:\Program Files\Common Files\Ahead
2007-10-04 15:53 d——– C:\Documents and Settings\All Users\Application Data\Avg7
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-01 20:28 ——— d—–w C:\Documents and Settings\Kev\Application Data\BitTorrent
2007-10-31 02:15 ——— d—–w C:\Program Files\HyperLobbyPro3
2007-10-28 19:21 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-10-26 21:06 ——— d—–w C:\Program Files\Java
2007-10-25 20:16 ——— d—–w C:\Documents and Settings\Kev\Application Data\teamspeak2
2007-10-24 21:12 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-10-23 01:32 ——— d—–w C:\Program Files\Google
2007-10-10 19:28 ——— d—–w C:\Program Files\BitTorrent
2007-10-10 01:54 ——— d—–w C:\Program Files\ModMan
2007-09-25 20:57 298,104 —-a-w C:\WINDOWS\system32\imon.dll
2007-09-25 00:03 ——— d—–w C:\Program Files\Sony
2007-09-25 00:02 ——— d—–w C:\Program Files\Sony Setup
2007-09-24 23:50 ——— d—–w C:\Documents and Settings\Kev\Application Data\Publish Providers
2007-09-22 03:09 ——— d—–w C:\Documents and Settings\Kev\Application Data\LimeWire
2007-09-13 04:00 ——— d—–w C:\Program Files\Windows Media Connect 2
2007-09-09 15:55 ——— d—–w C:\Documents and Settings\Kev\Application Data\Gearbox Software
2007-09-09 15:46 ——— d—–w C:\Program Files\Earned
2007-09-09 03:29 ——— d—–w C:\Program Files\Adverts
2007-09-09 03:29 ——— d—–w C:\Documents and Settings\Kev\Application Data\browsetwosafe
2007-09-07 01:36 ——— d—–w C:\Program Files\Microsoft SQL Server
2007-09-07 01:36 ——— d—–w C:\Documents and Settings\Kev\Application Data\Sony
2007-09-07 01:36 ——— d—–w C:\Documents and Settings\All Users\Application Data\Sony
2007-09-07 01:34 ——— d—–w C:\Program Files\Vstplugins
2007-09-07 01:27 ——— d—–w C:\Documents and Settings\Kev\Application Data\Sony Setup
2007-08-31 03:49 499,712 —-a-w C:\WINDOWS\system32\msvcp71.dll
2007-08-31 03:49 348,160 —-a-w C:\WINDOWS\system32\msvcr71.dll
2007-08-22 23:38 202,240 —-a-w C:\WINDOWS\system32\Yamaha 2007 R1.scr
2007-08-21 06:15 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-21 05:38 108,544 ——w C:\WINDOWS\system32\pxcpyi64.exe
2007-08-21 05:38 104,960 ——w C:\WINDOWS\system32\pxinsi64.exe
2007-08-16 00:05 49,152 —-a-w C:\npbittorrent.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nTrayFw"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe" [2005-04-29 21:22]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 03:43]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe" [2004-04-06 06:28]
"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-07 00:42]
"SystemGuardAlerter"="C:\Program Files\iolo\System Mechanic Professional 7\SystemGuardAlerter.exe" [2007-06-18 20:09]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-08-30 23:47]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 09:24]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"nwiz"="nwiz.exe" [2007-06-29 03:43 C:\WINDOWS\system32\nwiz.exe]
"Profiler"="C:\Program Files\Saitek\Software\Profiler.exe" [2004-07-26 13:04]
"SaiSmart"="C:\Program Files\Saitek\Software\SaiSmart.exe" [2004-07-26 13:04]
"SAIMON"="C:\WINDOWS\system32\SaiMon.exe" [2004-07-26 13:02]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-10-28 11:35]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 17:17]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00]
"System Mechanic Popup Blocker"="C:\Program Files\iolo\System Mechanic Professional 7\PopupBlocker.exe" [2007-06-18 20:09]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [2007-09-07 19:01]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 16:25]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 15:54]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-25 21:33]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]
C:\Documents and Settings\Kev\Start Menu\Programs\Startup\
MagicDisc.lnk - C:\Program Files\MagicDisc\MagicDisc.exe [2007-10-26 23:38:52]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=C:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Kev^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\Kev\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BIRDCAMP]
C:\DOCUME~1\Kev\APPLIC~1\BROWSE~1\kind part manager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
"C:\Program Files\BitTorrent\bittorrent.exe" –force_start_minimized
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
"C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD06]
C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSystemAnalyzer]
"C:\Program Files\iolo\System Mechanic Professional 7\SMSystemAnalyzer.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys
R3 SaiH2541;SaiH2541;C:\WINDOWS\system32\DRIVERS\SaiH2541.sys
R3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3218fc1-4f3b-11dc-a932-806d6172696f}]
\Shell\AutoRun\command - D:\Autorun.exe root.ini
.
Contents of the 'Scheduled Tasks' folder
"2007-10-31 03:49:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2007-11-01 23:24:00 C:\WINDOWS\Tasks\HP Usg Daily.job"
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-01 21:34:19
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-11-01 21:37:03 - machine was rebooted
.
— E O F —
HJT…
Logfile of HijackThis v1.99.1
Scan saved at 9:39:24 PM, on 11/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
C:\Program Files\iolo\System Mechanic Professional 7\IoloSGCtrl.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
C:\WINDOWS\system32\hphmon06.exe
C:\Program Files\iolo\System Mechanic Professional 7\SystemGuardAlerter.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Saitek\Software\SaiSmart.exe
C:\WINDOWS\system32\SaiMon.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iolo\System Mechanic Professional 7\PopupBlocker.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [SystemGuardAlerter] C:\Program Files\iolo\System Mechanic Professional 7\SystemGuardAlerter.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [SaiSmart] C:\Program Files\Saitek\Software\SaiSmart.exe
O4 - HKLM\..\Run: [SAIMON] C:\WINDOWS\system32\SaiMon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SDTray] C:\Program Files\Spyware Doctor\SDTrayApp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "C:\Program Files\iolo\System Mechanic Professional 7\PopupBlocker.exe"
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" –force_start_minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo…IOS/tgctlcm.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/v7/sit…b?1187658334000
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iolo DMV Service (ioloDMV) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - C:\Program Files\iolo\System Mechanic Professional 7\IoloSGCtrl.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
thanks
Kev
ComboFix 07-11-01.1** - Kev 2007-11-01 21:23:03.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.436 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Local Settings\Temporary Internet Files\Content.IE5\7SLRBDSN\ComboFix[1].exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Kev\Desktop\internet.lnk
C:\WINDOWS\hosts
C:\WINDOWS\system32\drivers\sfsync02.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
——-\LEGACY_SFSYNC02
——-\sfsync02
((((((((((((((((((((((((( Files Created from 2007-10-02 to 2007-11-02 )))))))))))))))))))))))))))))))
.
2007-11-01 21:20 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-10-31 21:58 d——– C:\Documents and Settings\Kev\Application Data\Grisoft
2007-10-31 21:58 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2007-10-31 21:58 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-10-31 17:34 3,524 –a—— C:\WINDOWS\system32\tmp.reg
2007-10-31 17:33 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2007-10-31 17:33 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2007-10-31 17:33 53,248 –a—— C:\WINDOWS\system32\Process.exe
2007-10-31 17:33 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2007-10-31 17:33 25,600 –a—— C:\WINDOWS\system32\WS2Fix.exe
2007-10-28 10:56 d——– C:\Program Files\Spyware Doctor
2007-10-28 10:56 d——– C:\Documents and Settings\Kev\Application Data\PC Tools
2007-10-28 10:56 83,536 –a—— C:\WINDOWS\system32\drivers\iksyssec.sys
2007-10-28 10:56 59,984 –a—— C:\WINDOWS\system32\drivers\iksysflt.sys
2007-10-28 10:56 52,304 –a—— C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-10-28 10:56 39,248 –a—— C:\WINDOWS\system32\drivers\ikfileflt.sys
2007-10-28 10:56 26,064 –a—— C:\WINDOWS\system32\drivers\kcom.sys
2007-10-28 10:11 63 –a—— C:\WINDOWS\system\SysSD.dll
2007-10-28 10:03 d——– C:\Program Files\Enigma Software Group
2007-10-27 15:30 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-27 15:16 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-10-27 13:48 d——– C:\Program Files\Symantec
2007-10-27 12:04 d——– C:\Program Files\McAfee.com
2007-10-27 12:04 348,160 –a—— C:\WINDOWS\system32\mcinsctl.dll
2007-10-27 12:04 270,336 –a—— C:\WINDOWS\system32\mcgdmgr.dll
2007-10-27 00:49 d——– C:\Documents and Settings\All Users\Application Data\McAfee
2007-10-27 00:12 d——– C:\WINDOWS\Sun
2007-10-26 23:48 d——– C:\Documents and Settings\All Users\Application Data\Symantec
2007-10-26 23:45 d——– C:\Program Files\Common Files\Symantec Shared
2007-10-26 23:38 d——– C:\Program Files\MagicDisc
2007-10-26 23:38 92,544 –a—— C:\WINDOWS\system32\drivers\mcdbus.sys
2007-10-26 23:32 d——– C:\Program Files\MagicISO
2007-10-26 23:10 d——– C:\Program Files\EZVideo
2007-10-26 23:10 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2007-10-26 16:36 d——– C:\Program Files\Alwil Software
2007-10-24 21:44 103,736 –a—— C:\WINDOWS\system32\PnkBstrB.exe
2007-10-24 21:44 66,872 –a—— C:\WINDOWS\system32\PnkBstrA.exe
2007-10-24 21:44 22,328 –a—— C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-10-24 20:51 236,824 –a—— C:\WINDOWS\system32\xactengine2_3.dll
2007-10-24 20:51 62,744 –a—— C:\WINDOWS\system32\xinput1_2.dll
2007-10-24 20:50 d——– C:\Program Files\America's Army Server Manager
2007-10-24 20:46 d——– C:\Program Files\America's Army
2007-10-24 16:32 163,840 –a—— C:\WINDOWS\system32\PrfAct.exe
2007-10-24 16:32 147,456 –a—— C:\WINDOWS\system32\SAICFG.dll
2007-10-24 16:32 122,880 –a—— C:\WINDOWS\system32\Nx.exe
2007-10-24 16:32 45,056 –a—— C:\WINDOWS\system32\SAIHOOK.dll
2007-10-24 16:32 40,960 –a—— C:\WINDOWS\system32\REnum.exe
2007-10-24 16:32 26,752 –a—— C:\WINDOWS\system32\drivers\SaiNtBus.sys
2007-10-24 16:32 15,616 –a—— C:\WINDOWS\system32\drivers\SaiMini.sys
2007-10-24 16:31 d——– C:\Program Files\Saitek
2007-10-24 16:31 102,400 –a—— C:\WINDOWS\system32\atl70.dll
2007-10-24 15:33 d——– C:\Documents and Settings\Kev\Application Data\vlc
2007-10-24 15:32 d——– C:\Program Files\VideoLAN
2007-10-23 22:12 d——– C:\Documents and Settings\All Users\Application Data\Saitek
2007-10-23 18:38 155,648 –a—— C:\WINDOWS\system32\nY.exe
2007-10-23 18:38 57,344 –a—— C:\WINDOWS\system32\SAIGON.dll
2007-10-23 18:38 45,056 –a—— C:\WINDOWS\system32\SAIKICK.dll
2007-10-22 21:33 d——– C:\Program Files\Common Files\Adobe
2007-10-20 12:03 d——– C:\Program Files\Microsoft Games
2007-10-14 11:24 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-10-09 21:46 d——– C:\Program Files\LoMan
2007-10-04 16:11 d——– C:\Documents and Settings\Kev\Application Data\Ahead
2007-10-04 16:10 d——– C:\Program Files\Nero
2007-10-04 16:10 d——– C:\Program Files\Common Files\Ahead
2007-10-04 15:53 d——– C:\Documents and Settings\All Users\Application Data\Avg7
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-01 20:28 ——— d—–w C:\Documents and Settings\Kev\Application Data\BitTorrent
2007-10-31 02:15 ——— d—–w C:\Program Files\HyperLobbyPro3
2007-10-28 19:21 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-10-26 21:06 ——— d—–w C:\Program Files\Java
2007-10-25 20:16 ——— d—–w C:\Documents and Settings\Kev\Application Data\teamspeak2
2007-10-24 21:12 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-10-23 01:32 ——— d—–w C:\Program Files\Google
2007-10-10 19:28 ——— d—–w C:\Program Files\BitTorrent
2007-10-10 01:54 ——— d—–w C:\Program Files\ModMan
2007-09-25 20:57 298,104 —-a-w C:\WINDOWS\system32\imon.dll
2007-09-25 00:03 ——— d—–w C:\Program Files\Sony
2007-09-25 00:02 ——— d—–w C:\Program Files\Sony Setup
2007-09-24 23:50 ——— d—–w C:\Documents and Settings\Kev\Application Data\Publish Providers
2007-09-22 03:09 ——— d—–w C:\Documents and Settings\Kev\Application Data\LimeWire
2007-09-13 04:00 ——— d—–w C:\Program Files\Windows Media Connect 2
2007-09-09 15:55 ——— d—–w C:\Documents and Settings\Kev\Application Data\Gearbox Software
2007-09-09 15:46 ——— d—–w C:\Program Files\Earned
2007-09-09 03:29 ——— d—–w C:\Program Files\Adverts
2007-09-09 03:29 ——— d—–w C:\Documents and Settings\Kev\Application Data\browsetwosafe
2007-09-07 01:36 ——— d—–w C:\Program Files\Microsoft SQL Server
2007-09-07 01:36 ——— d—–w C:\Documents and Settings\Kev\Application Data\Sony
2007-09-07 01:36 ——— d—–w C:\Documents and Settings\All Users\Application Data\Sony
2007-09-07 01:34 ——— d—–w C:\Program Files\Vstplugins
2007-09-07 01:27 ——— d—–w C:\Documents and Settings\Kev\Application Data\Sony Setup
2007-08-31 03:49 499,712 —-a-w C:\WINDOWS\system32\msvcp71.dll
2007-08-31 03:49 348,160 —-a-w C:\WINDOWS\system32\msvcr71.dll
2007-08-22 23:38 202,240 —-a-w C:\WINDOWS\system32\Yamaha 2007 R1.scr
2007-08-21 06:15 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-21 05:38 108,544 ——w C:\WINDOWS\system32\pxcpyi64.exe
2007-08-21 05:38 104,960 ——w C:\WINDOWS\system32\pxinsi64.exe
2007-08-16 00:05 49,152 —-a-w C:\npbittorrent.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nTrayFw"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe" [2005-04-29 21:22]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 03:43]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe" [2004-04-06 06:28]
"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-07 00:42]
"SystemGuardAlerter"="C:\Program Files\iolo\System Mechanic Professional 7\SystemGuardAlerter.exe" [2007-06-18 20:09]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-08-30 23:47]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 09:24]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"nwiz"="nwiz.exe" [2007-06-29 03:43 C:\WINDOWS\system32\nwiz.exe]
"Profiler"="C:\Program Files\Saitek\Software\Profiler.exe" [2004-07-26 13:04]
"SaiSmart"="C:\Program Files\Saitek\Software\SaiSmart.exe" [2004-07-26 13:04]
"SAIMON"="C:\WINDOWS\system32\SaiMon.exe" [2004-07-26 13:02]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-10-28 11:35]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 17:17]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00]
"System Mechanic Popup Blocker"="C:\Program Files\iolo\System Mechanic Professional 7\PopupBlocker.exe" [2007-06-18 20:09]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [2007-09-07 19:01]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 16:25]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 15:54]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-25 21:33]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]
C:\Documents and Settings\Kev\Start Menu\Programs\Startup\
MagicDisc.lnk - C:\Program Files\MagicDisc\MagicDisc.exe [2007-10-26 23:38:52]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=C:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Kev^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\Kev\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BIRDCAMP]
C:\DOCUME~1\Kev\APPLIC~1\BROWSE~1\kind part manager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
"C:\Program Files\BitTorrent\bittorrent.exe" –force_start_minimized
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
"C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD06]
C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSystemAnalyzer]
"C:\Program Files\iolo\System Mechanic Professional 7\SMSystemAnalyzer.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys
R3 SaiH2541;SaiH2541;C:\WINDOWS\system32\DRIVERS\SaiH2541.sys
R3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3218fc1-4f3b-11dc-a932-806d6172696f}]
\Shell\AutoRun\command - D:\Autorun.exe root.ini
.
Contents of the 'Scheduled Tasks' folder
"2007-10-31 03:49:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2007-11-01 23:24:00 C:\WINDOWS\Tasks\HP Usg Daily.job"
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-01 21:34:19
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-11-01 21:37:03 - machine was rebooted
.
— E O F —
HJT…
Logfile of HijackThis v1.99.1
Scan saved at 9:39:24 PM, on 11/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
C:\Program Files\iolo\System Mechanic Professional 7\IoloSGCtrl.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
C:\WINDOWS\system32\hphmon06.exe
C:\Program Files\iolo\System Mechanic Professional 7\SystemGuardAlerter.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Saitek\Software\SaiSmart.exe
C:\WINDOWS\system32\SaiMon.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iolo\System Mechanic Professional 7\PopupBlocker.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [SystemGuardAlerter] C:\Program Files\iolo\System Mechanic Professional 7\SystemGuardAlerter.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [SaiSmart] C:\Program Files\Saitek\Software\SaiSmart.exe
O4 - HKLM\..\Run: [SAIMON] C:\WINDOWS\system32\SaiMon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SDTray] C:\Program Files\Spyware Doctor\SDTrayApp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "C:\Program Files\iolo\System Mechanic Professional 7\PopupBlocker.exe"
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" –force_start_minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo…IOS/tgctlcm.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/v7/sit…b?1187658334000
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iolo DMV Service (ioloDMV) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - C:\Program Files\iolo\System Mechanic Professional 7\IoloSGCtrl.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
thanks
Kev
