danh
Didn't work. Here's the log:
ComboFix 07-12-21.4 - Daniel 2007-12-30 9:35:04.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1566 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.
((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-30 )))))))))))))))))))))))))))))))
.
2007-12-29 14:36 . 2007-12-29 14:36 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-12-29 11:40 . 2007-12-29 11:40 d——– C:\Documents and Settings\Daniel\DoctorWeb
2007-12-27 14:14 . 2007-12-27 14:14 d–h—– C:\WINDOWS\PIF
2007-12-27 08:59 . 2007-12-27 09:10 91,492 –a—— C:\WINDOWS\system32\drivers\klin.dat
2007-12-27 08:59 . 2007-12-27 09:10 85,860 –a—— C:\WINDOWS\system32\drivers\klick.dat
2007-12-27 08:57 . 2007-12-27 08:57 d——– C:\Program Files\Kaspersky Lab
2007-12-27 08:57 . 2007-12-30 09:07 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-27 08:57 . 2007-12-30 09:37 3,756,064 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2007-12-27 08:57 . 2007-12-29 23:25 52,580 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2007-12-27 08:57 . 2007-12-30 09:38 25,888 –ahs—- C:\WINDOWS\system32\drivers\fidbox2.dat
2007-12-27 08:57 . 2007-12-29 23:25 3,260 –ahs—- C:\WINDOWS\system32\drivers\fidbox2.idx
2007-12-27 08:54 . 2007-12-27 08:54 d——– C:\KAV
2007-12-27 08:50 . 2007-01-18 06:00 3,968 –a—— C:\WINDOWS\system32\drivers\AvgArCln.sys
2007-12-26 05:41 . 2007-12-26 05:42 d——– C:\Documents and Settings\Administrator.DANHAN.000\Application Data\AVG7
2007-12-26 00:02 . 2007-12-26 00:02 d——– C:\Documents and Settings\Administrator.DANHAN.000\Application Data\TuneUp Software
2007-12-25 22:19 . 2007-12-25 22:19 266,240 –a—— C:\WINDOWS\system32\config\systemprofile\NTUSER(2).DAT
2007-12-25 21:36 . 2007-12-30 09:04 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-25 21:18 . 2007-12-26 06:43 d——– C:\Program Files\Spyware Doctor
2007-12-25 21:18 . 2007-12-25 21:18 d——– C:\Documents and Settings\Daniel\Application Data\PC Tools
2007-12-25 21:18 . 2005-09-23 08:29 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-12-25 21:18 . 2007-12-25 21:19 74,240 –a—— C:\WINDOWS\system32\drivers\iksyssec.sys
2007-12-25 21:18 . 2007-12-25 21:19 56,832 –a—— C:\WINDOWS\system32\drivers\iksysflt.sys
2007-12-25 21:18 . 2007-10-18 00:14 41,288 –a—— C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-12-25 21:18 . 2007-10-18 00:16 29,000 –a—— C:\WINDOWS\system32\drivers\kcom.sys
2007-12-25 19:03 . 2007-12-25 19:03 d——– C:\Documents and Settings\Daniel\Application Data\iTunes Agent
2007-12-25 18:54 . 2007-12-25 18:54 d——– C:\Program Files\iTunes Agent
2007-12-25 14:42 . 2006-06-27 02:47 76,544 —–c— C:\WINDOWS\system32\dllcache\sdbus.sys
2007-12-25 14:42 . 2006-06-27 02:48 11,136 —–c— C:\WINDOWS\system32\dllcache\sffdisk.sys
2007-12-25 14:42 . 2006-06-27 02:48 10,368 —–c— C:\WINDOWS\system32\dllcache\sffp_sd.sys
2007-12-25 14:42 . 2006-06-27 02:48 9,984 ——— C:\WINDOWS\system32\drivers\sffp_mmc.sys
2007-12-25 14:42 . 2006-06-27 02:48 9,984 —–c— C:\WINDOWS\system32\dllcache\sffp_mmc.sys
2007-12-25 13:38 . 2007-12-25 13:38 d——– C:\Program Files\Windows Media Connect 2
2007-12-25 13:33 . 2007-12-25 14:54 d——– C:\WINDOWS\system32\drivers\UMDF
2007-12-17 00:49 . 2007-12-17 00:49 0 –ah—– C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2007-12-17 00:49 . 2007-12-17 00:49 0 –ah—– C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2007-12-17 00:48 . 2001-08-17 13:48 12,160 –a—— C:\WINDOWS\system32\drivers\mouhid.sys
2007-12-17 00:48 . 2001-08-17 13:48 12,160 –a–c— C:\WINDOWS\system32\dllcache\mouhid.sys
2007-12-17 00:47 . 2007-12-17 00:47 d——– C:\Documents and Settings\Daniel\Application Data\Logitech
2007-12-17 00:47 . 2007-12-17 00:47 d——– C:\Documents and Settings\All Users\Application Data\LogiShrd
2007-12-17 00:47 . 2004-08-03 23:10 25,600 –a—— C:\WINDOWS\system32\drivers\hidbth.sys
2007-12-17 00:47 . 2004-08-03 23:10 25,600 –a–c— C:\WINDOWS\system32\dllcache\hidbth.sys
2007-12-17 00:47 . 2001-08-17 14:02 9,600 –a—— C:\WINDOWS\system32\drivers\hidusb.sys
2007-12-17 00:47 . 2001-08-17 14:02 9,600 –a–c— C:\WINDOWS\system32\dllcache\hidusb.sys
2007-12-17 00:45 . 2007-12-17 00:45 d——– C:\Documents and Settings\All Users\Application Data\Logitech
2007-12-17 00:45 . 2007-11-15 10:06 301,656 –a—— C:\WINDOWS\system32\BtCoreIf.dll
2007-12-17 00:45 . 2007-11-15 10:07 170,512 –a—— C:\WINDOWS\system32\kemutb.dll
2007-12-17 00:45 . 2007-11-15 10:07 141,840 –a—— C:\WINDOWS\system32\KemUtil.dll
2007-12-17 00:45 . 2007-11-15 10:07 117,264 –a—— C:\WINDOWS\system32\KemWnd.dll
2007-12-17 00:45 . 2007-11-15 10:07 76,304 –a—— C:\WINDOWS\system32\KemXML.dll
2007-12-17 00:44 . 2007-12-17 00:44 d——– C:\Program Files\Logitech
2007-12-17 00:44 . 2007-12-17 00:45 d——– C:\Program Files\Common Files\Logishrd
2007-12-15 22:45 . 2007-12-15 22:45 d——– C:\Program Files\Sling Media
2007-12-15 18:45 . 2007-12-15 18:45 d——– C:\Documents and Settings\NetworkService\Application Data\Intel
2007-12-15 18:37 . 2007-03-28 19:42 29,704 –a—— C:\WINDOWS\system32\uxtuneup.dll
2007-12-15 18:36 . 2007-12-25 22:08 d——– C:\Program Files\TuneUp Utilities 2007
2007-12-15 18:36 . 2007-12-15 18:36 d——– C:\Documents and Settings\Daniel\Application Data\TuneUp Software
2007-12-15 18:35 . 2007-12-15 22:48 d——– C:\Documents and Settings\All Users\Application Data\TuneUp Software
2007-12-14 13:54 . 2007-12-14 13:54 57,208 –ah—– C:\WINDOWS\system32\mlfcache.dat
2007-12-14 13:07 . 2007-12-14 13:07 d——– C:\Program Files\Safari
2007-12-13 15:52 . 2007-12-13 15:52 d——– C:\Documents and Settings\Daniel\Application Data\Nokia Multimedia Player
2007-12-13 12:36 . 2007-12-13 12:36 d——– C:\Program Files\Common Files\PCSuite
2007-12-13 12:35 . 2007-12-13 12:35 d——– C:\Program Files\PC Connectivity Solution
2007-12-12 09:19 . 2007-02-22 10:15 137,216 –a—— C:\WINDOWS\system32\drivers\nmwcd.sys
2007-12-12 09:19 . 2007-02-22 10:15 65,536 –a—— C:\WINDOWS\system32\nmwcdcocls.dll
2007-12-12 09:19 . 2007-02-22 10:15 12,288 –a—— C:\WINDOWS\system32\drivers\nmwcdcm.sys
2007-12-12 09:19 . 2007-02-22 10:15 12,288 –a—— C:\WINDOWS\system32\drivers\nmwcdcj.sys
2007-12-12 09:19 . 2007-02-22 10:15 8,320 –a—— C:\WINDOWS\system32\drivers\nmwcdc.sys
2007-12-07 04:48 . 2007-12-07 04:48 d——– C:\Program Files\Symbian OS Tools
2007-12-07 04:48 . 2007-12-07 04:48 d——– C:\Program Files\Common Files\Symbian
2007-12-07 04:48 . 2007-12-07 04:48 d——– C:\Documents and Settings\Daniel\Application Data\InstallShield
2007-12-07 00:23 . 2007-12-07 00:23 d——– C:\Program Files\MSECache
2007-12-03 15:28 . 2004-08-03 23:10 35,456 –a—— C:\WINDOWS\system32\drivers\BTHPRINT.SYS
2007-12-03 15:28 . 2004-08-03 23:10 35,456 –a–c— C:\WINDOWS\system32\dllcache\bthprint.sys
2007-12-01 23:41 . 2007-12-01 23:41 d——– C:\epoc32
2007-11-29 18:00 . 2007-12-15 21:41 d——– C:\Documents and Settings\Daniel\Application Data\skypePM
2007-11-29 18:00 . 2007-12-15 22:17 d——– C:\Documents and Settings\Daniel\Application Data\Skype
2007-11-29 18:00 . 2007-11-29 18:00 32 –a—— C:\Documents and Settings\All Users\Application Data\ezsid.dat
2007-11-29 17:59 . 2007-12-01 21:16 d——– C:\Program Files\Skype
2007-11-29 17:59 . 2007-11-29 17:59 d——– C:\Program Files\Common Files\Skype
2007-11-29 17:59 . 2007-11-29 17:59 d——– C:\Documents and Settings\All Users\Application Data\Skype
2007-11-26 21:15 . 2007-11-26 21:15 d——– C:\Documents and Settings\All Users\Application Data\InstallShield
2007-11-26 20:47 . 2007-11-26 20:47 d——– C:\Documents and Settings\All Users\Application Data\Nokia
2007-11-26 15:39 . 2007-11-26 15:39 d——– C:\Documents and Settings\Daniel\Phone Browser
2007-11-26 15:38 . 2004-08-03 23:10 38,016 –a—— C:\WINDOWS\system32\drivers\bthmodem.sys
2007-11-26 15:38 . 2004-08-03 23:10 38,016 –a–c— C:\WINDOWS\system32\dllcache\bthmodem.sys
2007-11-26 14:53 . 2007-11-26 14:53 d——– C:\Program Files\LG Drivers
2007-11-26 14:53 . 2005-06-24 18:36 39,036 –a—— C:\WINDOWS\system32\drivers\lgusbmodem.sys
2007-11-26 14:53 . 2005-05-26 11:01 38,144 –a—— C:\WINDOWS\system32\drivers\lgusbdiag.sys
2007-11-26 14:53 . 2005-05-26 11:01 21,344 –a—— C:\WINDOWS\system32\drivers\lgusbbus.sys
2007-11-26 14:41 . 2007-12-25 14:54 d——– C:\Documents and Settings\All Users\Application Data\PC Suite
2007-11-26 14:40 . 2007-11-26 14:40 d——– C:\Program Files\DIFX
2007-11-26 14:40 . 2007-12-13 12:36 d——– C:\Program Files\Common Files\Nokia
2007-11-26 14:40 . 2007-11-26 15:39 d——– C:\Documents and Settings\Daniel\Application Data\PC Suite
2007-11-26 14:40 . 2007-12-25 18:39 d——– C:\Documents and Settings\Daniel\Application Data\Nokia
2007-11-26 14:39 . 2007-12-12 09:19 d——– C:\Program Files\Nokia
2007-11-26 14:39 . 2007-12-25 18:40 d——– C:\Documents and Settings\All Users\Application Data\Installations
2007-11-26 14:39 . 2007-02-22 10:15 90,624 –a—— C:\WINDOWS\system32\nmwcdcls.dll
2007-11-13 21:34 . 2007-11-13 21:34 d——– C:\Program Files\MusicIP
2007-11-13 21:34 . 2007-11-13 21:34 d——– C:\Documents and Settings\Daniel\Application Data\MusicIP
2007-11-07 14:32 . 2007-11-29 20:43 d——– C:\Program Files\IE7Pro
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-27 14:54 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg7
2007-12-27 07:55 ——— d—–w C:\Documents and Settings\Daniel\Application Data\AVG7
2007-12-17 06:45 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-16 00:56 ——— d—–w C:\Documents and Settings\Daniel\Application Data\CiscoCAA
2007-12-16 00:35 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-14 19:08 ——— d—–w C:\Documents and Settings\Daniel\Application Data\Apple Computer
2007-12-10 02:54 ——— d—–w C:\Program Files\Soulseek
2007-12-09 04:19 ——— d—–w C:\Program Files\eMusic Remote
2007-11-27 03:13 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-11-19 20:43 ——— d—–w C:\Program Files\GemMaster
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-29 22:35 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 23:40 222,720 —-a-w C:\WINDOWS\system32\wmasf.dll
2007-09-21 09:10 55,824 —-a-w C:\WINDOWS\KHALMNPR.Exe
2007-09-14 03:41 499,712 —-a-w C:\WINDOWS\system32\msvcp71.dll
2007-09-14 03:41 348,160 —-a-w C:\WINDOWS\system32\msvcr71.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-10 05:00 C:\WINDOWS\system32\bthprops.cpl]
"Bluetooth Connection Assistant"="LBTWIZ.exe" []
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 03:10 C:\WINDOWS\KHALMNPR.Exe]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-06-28 12:51]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" []
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-12-17 00:45:20]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll 2007-11-15 10:10 72208 c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Clean Access Agent.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Clean Access Agent.lnk
backup=C:\WINDOWS\pss\Clean Access Agent.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2007-06-19 08:21 61440 -ra—— C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.1\apdproxy.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-10 18:51 39792 –a—— C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
2005-10-07 13:13 176128 -ra—— C:\Program Files\Apoint\Apoint.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2005-08-05 12:56 64512 –a—— C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-26 23:47 31016 –a—— C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-05-11 22:12 49152 –a—— c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]
2005-06-17 00:26 49152 –a—— c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2007-11-02 18:36 267048 –a—— C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-07-12 03:00 132496 –a—— C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe -k netsvcs []
R3 BTHprint;Microsoft Bluetooth Printer Class;C:\WINDOWS\system32\DRIVERS\bthprint.sys [2004-08-03 23:10]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 14:58]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
"2007-12-29 16:33:44 C:\WINDOWS\Tasks\User_Feed_Synchronization-{B12B5C68-40DB-4549-ACF1-A0BCDCABFC2F}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-30 09:38:31
Windows 5.1.2600 Service Pack 2 NTFS
detected NTDLL code modification:
ZwClose
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-12-30 9:39:50
C:\ComboFix2.txt … 2007-12-29 01:20
C:\ComboFix3.txt … 2007-12-27 01:38
.
2007-12-27 07:49:50 — E O F —
ComboFix 07-12-21.4 - Daniel 2007-12-30 9:35:04.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1566 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.
((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-30 )))))))))))))))))))))))))))))))
.
2007-12-29 14:36 . 2007-12-29 14:36 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-12-29 11:40 . 2007-12-29 11:40 d——– C:\Documents and Settings\Daniel\DoctorWeb
2007-12-27 14:14 . 2007-12-27 14:14 d–h—– C:\WINDOWS\PIF
2007-12-27 08:59 . 2007-12-27 09:10 91,492 –a—— C:\WINDOWS\system32\drivers\klin.dat
2007-12-27 08:59 . 2007-12-27 09:10 85,860 –a—— C:\WINDOWS\system32\drivers\klick.dat
2007-12-27 08:57 . 2007-12-27 08:57 d——– C:\Program Files\Kaspersky Lab
2007-12-27 08:57 . 2007-12-30 09:07 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-27 08:57 . 2007-12-30 09:37 3,756,064 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2007-12-27 08:57 . 2007-12-29 23:25 52,580 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2007-12-27 08:57 . 2007-12-30 09:38 25,888 –ahs—- C:\WINDOWS\system32\drivers\fidbox2.dat
2007-12-27 08:57 . 2007-12-29 23:25 3,260 –ahs—- C:\WINDOWS\system32\drivers\fidbox2.idx
2007-12-27 08:54 . 2007-12-27 08:54 d——– C:\KAV
2007-12-27 08:50 . 2007-01-18 06:00 3,968 –a—— C:\WINDOWS\system32\drivers\AvgArCln.sys
2007-12-26 05:41 . 2007-12-26 05:42 d——– C:\Documents and Settings\Administrator.DANHAN.000\Application Data\AVG7
2007-12-26 00:02 . 2007-12-26 00:02 d——– C:\Documents and Settings\Administrator.DANHAN.000\Application Data\TuneUp Software
2007-12-25 22:19 . 2007-12-25 22:19 266,240 –a—— C:\WINDOWS\system32\config\systemprofile\NTUSER(2).DAT
2007-12-25 21:36 . 2007-12-30 09:04 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-25 21:18 . 2007-12-26 06:43 d——– C:\Program Files\Spyware Doctor
2007-12-25 21:18 . 2007-12-25 21:18 d——– C:\Documents and Settings\Daniel\Application Data\PC Tools
2007-12-25 21:18 . 2005-09-23 08:29 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-12-25 21:18 . 2007-12-25 21:19 74,240 –a—— C:\WINDOWS\system32\drivers\iksyssec.sys
2007-12-25 21:18 . 2007-12-25 21:19 56,832 –a—— C:\WINDOWS\system32\drivers\iksysflt.sys
2007-12-25 21:18 . 2007-10-18 00:14 41,288 –a—— C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-12-25 21:18 . 2007-10-18 00:16 29,000 –a—— C:\WINDOWS\system32\drivers\kcom.sys
2007-12-25 19:03 . 2007-12-25 19:03 d——– C:\Documents and Settings\Daniel\Application Data\iTunes Agent
2007-12-25 18:54 . 2007-12-25 18:54 d——– C:\Program Files\iTunes Agent
2007-12-25 14:42 . 2006-06-27 02:47 76,544 —–c— C:\WINDOWS\system32\dllcache\sdbus.sys
2007-12-25 14:42 . 2006-06-27 02:48 11,136 —–c— C:\WINDOWS\system32\dllcache\sffdisk.sys
2007-12-25 14:42 . 2006-06-27 02:48 10,368 —–c— C:\WINDOWS\system32\dllcache\sffp_sd.sys
2007-12-25 14:42 . 2006-06-27 02:48 9,984 ——— C:\WINDOWS\system32\drivers\sffp_mmc.sys
2007-12-25 14:42 . 2006-06-27 02:48 9,984 —–c— C:\WINDOWS\system32\dllcache\sffp_mmc.sys
2007-12-25 13:38 . 2007-12-25 13:38 d——– C:\Program Files\Windows Media Connect 2
2007-12-25 13:33 . 2007-12-25 14:54 d——– C:\WINDOWS\system32\drivers\UMDF
2007-12-17 00:49 . 2007-12-17 00:49 0 –ah—– C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2007-12-17 00:49 . 2007-12-17 00:49 0 –ah—– C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2007-12-17 00:48 . 2001-08-17 13:48 12,160 –a—— C:\WINDOWS\system32\drivers\mouhid.sys
2007-12-17 00:48 . 2001-08-17 13:48 12,160 –a–c— C:\WINDOWS\system32\dllcache\mouhid.sys
2007-12-17 00:47 . 2007-12-17 00:47 d——– C:\Documents and Settings\Daniel\Application Data\Logitech
2007-12-17 00:47 . 2007-12-17 00:47 d——– C:\Documents and Settings\All Users\Application Data\LogiShrd
2007-12-17 00:47 . 2004-08-03 23:10 25,600 –a—— C:\WINDOWS\system32\drivers\hidbth.sys
2007-12-17 00:47 . 2004-08-03 23:10 25,600 –a–c— C:\WINDOWS\system32\dllcache\hidbth.sys
2007-12-17 00:47 . 2001-08-17 14:02 9,600 –a—— C:\WINDOWS\system32\drivers\hidusb.sys
2007-12-17 00:47 . 2001-08-17 14:02 9,600 –a–c— C:\WINDOWS\system32\dllcache\hidusb.sys
2007-12-17 00:45 . 2007-12-17 00:45 d——– C:\Documents and Settings\All Users\Application Data\Logitech
2007-12-17 00:45 . 2007-11-15 10:06 301,656 –a—— C:\WINDOWS\system32\BtCoreIf.dll
2007-12-17 00:45 . 2007-11-15 10:07 170,512 –a—— C:\WINDOWS\system32\kemutb.dll
2007-12-17 00:45 . 2007-11-15 10:07 141,840 –a—— C:\WINDOWS\system32\KemUtil.dll
2007-12-17 00:45 . 2007-11-15 10:07 117,264 –a—— C:\WINDOWS\system32\KemWnd.dll
2007-12-17 00:45 . 2007-11-15 10:07 76,304 –a—— C:\WINDOWS\system32\KemXML.dll
2007-12-17 00:44 . 2007-12-17 00:44 d——– C:\Program Files\Logitech
2007-12-17 00:44 . 2007-12-17 00:45 d——– C:\Program Files\Common Files\Logishrd
2007-12-15 22:45 . 2007-12-15 22:45 d——– C:\Program Files\Sling Media
2007-12-15 18:45 . 2007-12-15 18:45 d——– C:\Documents and Settings\NetworkService\Application Data\Intel
2007-12-15 18:37 . 2007-03-28 19:42 29,704 –a—— C:\WINDOWS\system32\uxtuneup.dll
2007-12-15 18:36 . 2007-12-25 22:08 d——– C:\Program Files\TuneUp Utilities 2007
2007-12-15 18:36 . 2007-12-15 18:36 d——– C:\Documents and Settings\Daniel\Application Data\TuneUp Software
2007-12-15 18:35 . 2007-12-15 22:48 d——– C:\Documents and Settings\All Users\Application Data\TuneUp Software
2007-12-14 13:54 . 2007-12-14 13:54 57,208 –ah—– C:\WINDOWS\system32\mlfcache.dat
2007-12-14 13:07 . 2007-12-14 13:07 d——– C:\Program Files\Safari
2007-12-13 15:52 . 2007-12-13 15:52 d——– C:\Documents and Settings\Daniel\Application Data\Nokia Multimedia Player
2007-12-13 12:36 . 2007-12-13 12:36 d——– C:\Program Files\Common Files\PCSuite
2007-12-13 12:35 . 2007-12-13 12:35 d——– C:\Program Files\PC Connectivity Solution
2007-12-12 09:19 . 2007-02-22 10:15 137,216 –a—— C:\WINDOWS\system32\drivers\nmwcd.sys
2007-12-12 09:19 . 2007-02-22 10:15 65,536 –a—— C:\WINDOWS\system32\nmwcdcocls.dll
2007-12-12 09:19 . 2007-02-22 10:15 12,288 –a—— C:\WINDOWS\system32\drivers\nmwcdcm.sys
2007-12-12 09:19 . 2007-02-22 10:15 12,288 –a—— C:\WINDOWS\system32\drivers\nmwcdcj.sys
2007-12-12 09:19 . 2007-02-22 10:15 8,320 –a—— C:\WINDOWS\system32\drivers\nmwcdc.sys
2007-12-07 04:48 . 2007-12-07 04:48 d——– C:\Program Files\Symbian OS Tools
2007-12-07 04:48 . 2007-12-07 04:48 d——– C:\Program Files\Common Files\Symbian
2007-12-07 04:48 . 2007-12-07 04:48 d——– C:\Documents and Settings\Daniel\Application Data\InstallShield
2007-12-07 00:23 . 2007-12-07 00:23 d——– C:\Program Files\MSECache
2007-12-03 15:28 . 2004-08-03 23:10 35,456 –a—— C:\WINDOWS\system32\drivers\BTHPRINT.SYS
2007-12-03 15:28 . 2004-08-03 23:10 35,456 –a–c— C:\WINDOWS\system32\dllcache\bthprint.sys
2007-12-01 23:41 . 2007-12-01 23:41 d——– C:\epoc32
2007-11-29 18:00 . 2007-12-15 21:41 d——– C:\Documents and Settings\Daniel\Application Data\skypePM
2007-11-29 18:00 . 2007-12-15 22:17 d——– C:\Documents and Settings\Daniel\Application Data\Skype
2007-11-29 18:00 . 2007-11-29 18:00 32 –a—— C:\Documents and Settings\All Users\Application Data\ezsid.dat
2007-11-29 17:59 . 2007-12-01 21:16 d——– C:\Program Files\Skype
2007-11-29 17:59 . 2007-11-29 17:59 d——– C:\Program Files\Common Files\Skype
2007-11-29 17:59 . 2007-11-29 17:59 d——– C:\Documents and Settings\All Users\Application Data\Skype
2007-11-26 21:15 . 2007-11-26 21:15 d——– C:\Documents and Settings\All Users\Application Data\InstallShield
2007-11-26 20:47 . 2007-11-26 20:47 d——– C:\Documents and Settings\All Users\Application Data\Nokia
2007-11-26 15:39 . 2007-11-26 15:39 d——– C:\Documents and Settings\Daniel\Phone Browser
2007-11-26 15:38 . 2004-08-03 23:10 38,016 –a—— C:\WINDOWS\system32\drivers\bthmodem.sys
2007-11-26 15:38 . 2004-08-03 23:10 38,016 –a–c— C:\WINDOWS\system32\dllcache\bthmodem.sys
2007-11-26 14:53 . 2007-11-26 14:53 d——– C:\Program Files\LG Drivers
2007-11-26 14:53 . 2005-06-24 18:36 39,036 –a—— C:\WINDOWS\system32\drivers\lgusbmodem.sys
2007-11-26 14:53 . 2005-05-26 11:01 38,144 –a—— C:\WINDOWS\system32\drivers\lgusbdiag.sys
2007-11-26 14:53 . 2005-05-26 11:01 21,344 –a—— C:\WINDOWS\system32\drivers\lgusbbus.sys
2007-11-26 14:41 . 2007-12-25 14:54 d——– C:\Documents and Settings\All Users\Application Data\PC Suite
2007-11-26 14:40 . 2007-11-26 14:40 d——– C:\Program Files\DIFX
2007-11-26 14:40 . 2007-12-13 12:36 d——– C:\Program Files\Common Files\Nokia
2007-11-26 14:40 . 2007-11-26 15:39 d——– C:\Documents and Settings\Daniel\Application Data\PC Suite
2007-11-26 14:40 . 2007-12-25 18:39 d——– C:\Documents and Settings\Daniel\Application Data\Nokia
2007-11-26 14:39 . 2007-12-12 09:19 d——– C:\Program Files\Nokia
2007-11-26 14:39 . 2007-12-25 18:40 d——– C:\Documents and Settings\All Users\Application Data\Installations
2007-11-26 14:39 . 2007-02-22 10:15 90,624 –a—— C:\WINDOWS\system32\nmwcdcls.dll
2007-11-13 21:34 . 2007-11-13 21:34 d——– C:\Program Files\MusicIP
2007-11-13 21:34 . 2007-11-13 21:34 d——– C:\Documents and Settings\Daniel\Application Data\MusicIP
2007-11-07 14:32 . 2007-11-29 20:43 d——– C:\Program Files\IE7Pro
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-27 14:54 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg7
2007-12-27 07:55 ——— d—–w C:\Documents and Settings\Daniel\Application Data\AVG7
2007-12-17 06:45 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-16 00:56 ——— d—–w C:\Documents and Settings\Daniel\Application Data\CiscoCAA
2007-12-16 00:35 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-14 19:08 ——— d—–w C:\Documents and Settings\Daniel\Application Data\Apple Computer
2007-12-10 02:54 ——— d—–w C:\Program Files\Soulseek
2007-12-09 04:19 ——— d—–w C:\Program Files\eMusic Remote
2007-11-27 03:13 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-11-19 20:43 ——— d—–w C:\Program Files\GemMaster
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-29 22:35 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 23:40 222,720 —-a-w C:\WINDOWS\system32\wmasf.dll
2007-09-21 09:10 55,824 —-a-w C:\WINDOWS\KHALMNPR.Exe
2007-09-14 03:41 499,712 —-a-w C:\WINDOWS\system32\msvcp71.dll
2007-09-14 03:41 348,160 —-a-w C:\WINDOWS\system32\msvcr71.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-10 05:00 C:\WINDOWS\system32\bthprops.cpl]
"Bluetooth Connection Assistant"="LBTWIZ.exe" []
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 03:10 C:\WINDOWS\KHALMNPR.Exe]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-06-28 12:51]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" []
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-12-17 00:45:20]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll 2007-11-15 10:10 72208 c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Clean Access Agent.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Clean Access Agent.lnk
backup=C:\WINDOWS\pss\Clean Access Agent.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2007-06-19 08:21 61440 -ra—— C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.1\apdproxy.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-10 18:51 39792 –a—— C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
2005-10-07 13:13 176128 -ra—— C:\Program Files\Apoint\Apoint.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2005-08-05 12:56 64512 –a—— C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-26 23:47 31016 –a—— C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-05-11 22:12 49152 –a—— c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]
2005-06-17 00:26 49152 –a—— c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2007-11-02 18:36 267048 –a—— C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-07-12 03:00 132496 –a—— C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe -k netsvcs []
R3 BTHprint;Microsoft Bluetooth Printer Class;C:\WINDOWS\system32\DRIVERS\bthprint.sys [2004-08-03 23:10]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 14:58]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
"2007-12-29 16:33:44 C:\WINDOWS\Tasks\User_Feed_Synchronization-{B12B5C68-40DB-4549-ACF1-A0BCDCABFC2F}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-30 09:38:31
Windows 5.1.2600 Service Pack 2 NTFS
detected NTDLL code modification:
ZwClose
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-12-30 9:39:50
C:\ComboFix2.txt … 2007-12-29 01:20
C:\ComboFix3.txt … 2007-12-27 01:38
.
2007-12-27 07:49:50 — E O F —
