SaCo
Topic Starter
well im the total n00b
i can clearly see the infected files in this log the .EXE
pmnnm.exe is what i see a lot
i think combo fix got it but now that i reboot it says cant find temp image over and over…and i have to reintall nod 32 everytime
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:03, on 2008-01-01
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\ISS\BlackICE\blackd.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Belkin\PCI F5D7000\Wireless Utility\Belkinwcui.exe
C:\Program Files\ISS\BlackICE\blackice.exe
C:\Program Files\Belkin\Nostromo\nost_LM.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\Program Files\Xfire\xfire.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Documents and Settings\n94\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [StartupMonitor] "C:\Program Files\SNP Software\StartupMonitor\StartupMonitor.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [CmPCIaudio] RunDll32 CMICNFG3.CPL,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Copperhead] C:\Program Files\Razer\Copperhead\razerhid.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Belkin Wireless Utility.lnk = C:\Program Files\Belkin\PCI F5D7000\Wireless Utility\Belkinwcui.exe
O4 - Global Startup: BlackICE PC Protection.lnk = C:\Program Files\ISS\BlackICE\blackice.exe
O4 - Global Startup: Nostromo Loadout Manager.lnk = ?
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u…can_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1198906380356
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1198906371685
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\blackd.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\rapapp.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
–
End of file - 6906 bytes
ComboFix 07-12-31.4 - n94 2008-01-01 12:36:23.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.591 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\_000005_.tmp.dll
C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\_000007_.tmp.dll
C:\WINDOWS\system32\csnbbqts.ini
C:\WINDOWS\system32\mnnmp.ini
C:\WINDOWS\system32\mnnmp.ini2
C:\WINDOWS\system32\pmnnm.dll
C:\WINDOWS\system32\rqrrsqr.dll
C:\WINDOWS\system32\stqbbnsc.dll
C:\WINDOWS\system32\vpyximlw.dll
C:\WINDOWS\system32\wlmixypv.ini
C:\WINDOWS\system32\xwajeway.dll
.
((((((((((((((((((((((((( Files Created from 2007-12-01 to 2008-01-01 )))))))))))))))))))))))))))))))
.
2008-01-01 12:40 . 2008-01-01 12:40 d——– C:\WINDOWS\system32\xircom
2008-01-01 12:40 . 2008-01-01 12:40 d——– C:\Program Files\microsoft frontpage
2008-01-01 12:34 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-01 12:33 . 2008-01-01 12:33 d——– C:\Program Files\Yahoo!
2008-01-01 12:33 . 2008-01-01 12:33 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-01-01 12:32 . 2008-01-01 12:33 d——– C:\Program Files\CCleaner
2008-01-01 04:31 . 2008-01-01 12:36 d——– C:\Program Files\Trojan Remover
2008-01-01 04:31 . 2008-01-01 04:31 d——– C:\Documents and Settings\n94\Application Data\Simply Super Software
2008-01-01 04:31 . 2008-01-01 04:31 d——– C:\Documents and Settings\All Users\Application Data\Simply Super Software
2008-01-01 04:31 . 2006-05-25 14:52 162,304 –a—— C:\WINDOWS\system32\ztvunrar36.dll
2008-01-01 04:31 . 2003-02-02 19:06 153,088 –a—— C:\WINDOWS\system32\UNRAR3.dll
2008-01-01 04:31 . 2005-08-26 00:50 77,312 –a—— C:\WINDOWS\system32\ztvunace26.dll
2008-01-01 04:31 . 2002-03-06 00:00 75,264 –a—— C:\WINDOWS\system32\unacev2.dll
2008-01-01 04:31 . 2006-06-19 12:01 69,632 –a—— C:\WINDOWS\system32\ztvcabinet.dll
2008-01-01 04:30 . 1999-12-12 11:01 44,032 –a—— C:\WINDOWS\system32\CTSVCCDA.EXE
2008-01-01 04:30 . 1999-11-17 11:00 25,088 –a—— C:\WINDOWS\system32\CTSVCCTL.EXE
2008-01-01 04:26 . 2008-01-01 04:26 d——– C:\Program Files\uTorrent
2008-01-01 04:26 . 2008-01-01 04:35 d——– C:\Program Files\Creative
2008-01-01 04:26 . 2008-01-01 04:38 d——– C:\Documents and Settings\n94\Application Data\uTorrent
2008-01-01 04:11 . 2008-01-01 04:12 d——– C:\Documents and Settings\n94\Application Data\PrevxCSI
2008-01-01 04:11 . 2008-01-01 04:11 d——– C:\Documents and Settings\All Users\Application Data\Prevx
2008-01-01 04:07 . 2008-01-01 04:36 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-01 02:28 . 2008-01-01 02:28 d——– C:\Documents and Settings\n94\Shared
2008-01-01 02:28 . 2008-01-01 02:35 d——– C:\Documents and Settings\n94\Incomplete
2008-01-01 02:27 . 2008-01-01 02:35 d——– C:\Documents and Settings\n94\Application Data\LimeWire
2008-01-01 02:26 . 2008-01-01 02:26 d——– C:\Program Files\Java
2008-01-01 02:26 . 2007-07-12 02:22 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-01-01 02:25 . 2008-01-01 02:25 d——– C:\Program Files\Common Files\Java
2008-01-01 02:24 . 2008-01-01 02:26 d——– C:\Program Files\LimeWire
2008-01-01 02:15 . 2008-01-01 02:36 d——– C:\Documents and Settings\n94\Application Data\SoundSpectrum
2008-01-01 01:35 . 2008-01-01 01:36 d——– C:\Program Files\Paint.NET
2008-01-01 01:08 . 2008-01-01 01:08 d——– C:\Program Files\SoundSpectrum
2008-01-01 01:08 . 2008-01-01 04:49 69,776 –ahs—- C:\WINDOWS\system32\mnnmp.ini2.ren
2008-01-01 01:08 . 2008-01-01 04:51 69,776 –ahs—- C:\WINDOWS\system32\mnnmp.ini.ren
2008-01-01 01:08 . 2008-01-01 01:08 1 –a—— C:\WINDOWS\system32\pmnnm.exe
2008-01-01 01:04 . 2008-01-01 12:36 d——– C:\Program Files\Winamp
2008-01-01 01:04 . 2008-01-01 02:36 d——– C:\Documents and Settings\n94\Application Data\Winamp
2007-12-31 01:37 . 2007-12-31 01:37 d——– C:\Documents and Settings\n94\Application Data\vlc
2007-12-31 01:32 . 2007-12-31 01:32 d——– C:\Program Files\VideoLAN
2007-12-31 01:24 . 2007-12-31 01:24 d——– C:\Program Files\THQ
2007-12-31 00:22 . 2007-12-31 00:22 d——– C:\Documents and Settings\LocalService\Application Data\Xfire
2007-12-30 23:32 . 2007-12-30 23:32 d——– C:\Documents and Settings\n94\Application Data\CyberLink
2007-12-30 23:26 . 2007-12-30 23:26 d——– C:\Documents and Settings\All Users\Application Data\CyberLink
2007-12-30 23:25 . 2007-12-30 23:25 d——– C:\Program Files\CyberLink
2007-12-30 23:25 . 2003-03-18 20:14 499,712 –a—— C:\WINDOWS\system32\msvcp71.dll
2007-12-30 23:25 . 2003-02-21 04:42 348,160 –a—— C:\WINDOWS\system32\msvcr71.dll
2007-12-30 23:25 . 2001-03-08 18:30 24,064 –a—— C:\WINDOWS\system32\msxml3a.dll
2007-12-30 23:17 . 2007-12-30 23:17 d——– C:\Documents and Settings\NetworkService\Application Data\Xfire
2007-12-30 23:14 . 2007-12-30 23:14 d——– C:\Program Files\Razer
2007-12-30 23:14 . 2007-12-30 23:14 d——– C:\Documents and Settings\n94\Application Data\InstallShield
2007-12-30 23:14 . 2005-11-10 09:15 69,632 –a—— C:\WINDOWS\system32\copperhd.cpl
2007-12-30 23:14 . 2005-12-21 11:23 14,592 –a—— C:\WINDOWS\system32\drivers\USBICP.sys
2007-12-29 23:31 . 2007-12-29 23:31 d——– C:\Program Files\MagicISO
2007-12-29 23:29 . 2007-12-29 23:30 d——– C:\Program Files\MagicDisc
2007-12-29 23:29 . 2007-09-05 01:46 92,544 –a—— C:\WINDOWS\system32\drivers\mcdbus.sys
2007-12-29 22:27 . 2007-12-29 22:27 1,158 –a—— C:\WINDOWS\mozver.dat
2007-12-29 05:09 . 2007-12-29 05:09 0 –a—— C:\WINDOWS\nsreg.dat
2007-12-29 04:08 . 2007-12-30 02:48 d——– C:\Documents and Settings\n94\Contacts
2007-12-29 04:01 . 2004-08-03 23:08 25,600 –a—— C:\WINDOWS\system32\drivers\usbser.sys
2007-12-29 03:34 . 2007-12-29 03:41 d——– C:\Program Files\Windows Live
2007-12-29 03:34 . 2007-12-29 03:37 d–hsc— C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-29 03:34 . 2007-12-29 03:34 d——– C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-29 02:17 . 2007-05-16 16:45 1,124,720 –a—— C:\WINDOWS\system32\D3DCompiler_34.dll
2007-12-29 02:17 . 2007-05-16 16:45 443,752 –a—— C:\WINDOWS\system32\d3dx10_34.dll
2007-12-29 02:17 . 2007-05-31 19:30 266,088 –a—— C:\WINDOWS\system32\xactengine2_8.dll
2007-12-29 02:17 . 2007-05-31 19:29 18,280 –a—— C:\WINDOWS\system32\x3daudio1_2.dll
2007-12-29 01:53 . 2008-01-01 02:38 107,832 –a—— C:\WINDOWS\system32\PnkBstrB.exe
2007-12-29 01:53 . 2007-12-29 04:22 66,872 –a—— C:\WINDOWS\system32\PnkBstrA.exe
2007-12-29 01:53 . 2008-01-01 02:38 22,328 –a—— C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-12-29 01:53 . 2007-12-29 01:53 22,328 –a—— C:\Documents and Settings\n94\Application Data\PnkBstrK.sys
2007-12-29 01:53 . 2007-12-29 01:53 319 –a—— C:\WINDOWS\game.ini
2007-12-29 01:39 . 2007-12-29 01:39 d——– C:\Program Files\Activision
2007-12-29 01:35 . 2007-12-29 01:35 d–hs—- C:\WINDOWS\ftpcache
2007-12-29 00:59 . 2007-12-29 03:40 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-12-29 00:59 . 2007-12-29 00:59 d——– C:\Documents and Settings\n94\Application Data\Belkin
2007-12-29 00:59 . 2007-08-14 10:57 240,112 -ra—— C:\WINDOWS\system32\bgcpsp2.dll
2007-12-29 00:59 . 2007-08-14 10:57 23,040 -ra—— C:\WINDOWS\system32\drivers\bcgame.sys
2007-12-29 00:39 . 2007-12-29 00:39 d——– C:\Program Files\dayam NFO Viewer
2007-12-29 00:38 . 2007-12-29 00:38 d——– C:\Program Files\SmartFTP Client 2.5 Setup Files
2007-12-29 00:38 . 2007-12-29 00:38 d——– C:\Program Files\SmartFTP Client
2007-12-29 00:38 . 2007-12-29 00:38 d——– C:\Documents and Settings\n94\Application Data\SmartFTP
2007-12-29 00:30 . 2007-12-29 00:30 d——– C:\Program Files\Ventrilo
2007-12-29 00:30 . 2007-12-29 00:30 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-12-29 00:30 . 2008-01-01 00:37 d——– C:\Documents and Settings\n94\Application Data\Ventrilo
2007-12-29 00:23 . 2007-12-29 00:23 d——– C:\WINDOWS\nview
2007-12-29 00:23 . 2007-12-05 02:53 356,352 –a—— C:\WINDOWS\system32\NVUNINST.EXE
2007-12-29 00:23 . 2007-12-05 01:41 356,352 –a—— C:\WINDOWS\system32\nvudisp.exe
2007-12-29 00:23 . 2007-12-29 00:27 163,353 –a—— C:\WINDOWS\system32\nvapps.xml
2007-12-29 00:23 . 2007-12-05 01:41 17,737 –a—— C:\WINDOWS\system32\nvdisp.nvu
2007-12-29 00:22 . 2007-12-29 00:22 d——– C:\NVIDIA
2007-12-29 00:21 . 2006-06-14 03:17 82,944 –a—— C:\WINDOWS\system32\drivers\wdmaud.sys
2007-12-29 00:21 . 2004-08-03 23:07 52,864 –a—— C:\WINDOWS\system32\drivers\DMusic.sys
2007-12-29 00:21 . 2006-06-14 02:50 6,272 –a—— C:\WINDOWS\system32\drivers\splitter.sys
2007-12-29 00:21 . 2007-12-29 22:52 635 –a—— C:\WINDOWS\system\Cmicnfg3.ini
2007-12-29 00:20 . 2007-12-29 00:20 d——– C:\Program Files\Xtreme Sound PCI
2007-12-29 00:19 . 2007-12-29 00:19 d——– C:\Program Files\Xtreme Sound Driver Setup
2007-12-29 00:08 . 2007-12-31 00:22 d——– C:\Program Files\Xfire
2007-12-29 00:08 . 2007-12-31 05:10 d——– C:\Documents and Settings\n94\Application Data\Xfire
2007-12-29 00:07 . 2007-12-29 00:07 d—s—- C:\Program Files\HLSW
2007-12-29 00:07 . 2007-12-30 23:19 d——– C:\Documents and Settings\n94\Application Data\HLSW
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-01 18:36 ——— d—–w C:\Program Files\Steam
2008-01-01 10:35 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-29 06:59 ——— d—–w C:\Program Files\Belkin
2007-12-29 06:19 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-12-29 05:59 ——— d—–w C:\Program Files\MSXML 6.0
2007-12-29 05:59 ——— d—–w C:\Program Files\MSXML 4.0
2007-12-29 05:58 ——— d—–w C:\Program Files\Windows Media Connect 2
2007-12-29 05:57 ——— d—–w C:\Program Files\Logitech
2007-12-29 05:57 ——— d—–w C:\Documents and Settings\All Users\Application Data\Logitech
2007-12-29 05:29 17,801 —-a-w C:\WINDOWS\system32\drivers\AegisP.sys
2007-12-29 05:26 10 —-a-w C:\WINDOWS\system32\drivers\tmbi.sys
2007-12-29 05:26 ——— d—–w C:\Program Files\ISS
2007-12-29 05:24 61,440 —-a-w C:\WINDOWS\keygen.dll
2007-12-29 05:17 ——— d—–w C:\Documents and Settings\All Users\Application Data\ESET
2007-12-29 05:04 ——— d—–w C:\Program Files\SNP Software
2007-12-05 07:41 7,435,392 —-a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-08 22:17 30,728 —-a-w C:\WINDOWS\system32\drivers\epfwtdir.sys
2007-11-08 22:10 27,656 —-a-w C:\WINDOWS\system32\drivers\easdrv.sys
2007-11-08 22:09 33,800 —-a-w C:\WINDOWS\system32\drivers\eamon.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\steam\steam.exe" [2008-01-01 12:36 1]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-01-01 12:36 1]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2008-01-01 12:36 1]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-01 12:36 1]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2008-01-01 12:36 1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartupMonitor"="C:\Program Files\SNP Software\StartupMonitor\StartupMonitor.exe" [2008-01-01 12:36 1]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-01-01 12:36 1]
"Launch LCDMon"="C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2008-01-01 12:36 1]
"Launch LGDCore"="C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2008-01-01 12:36 1]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2008-01-01 12:36 1]
"CmPCIaudio"="CMICNFG3.CPL" []
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"Copperhead"="C:\Program Files\Razer\Copperhead\razerhid.exe" [2008-01-01 12:36 1]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2008-01-01 12:36 1]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2008-01-01 12:36 1]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-01 12:36 1]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2008-01-01 12:36 1]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-01-01 12:36 1]
C:\Documents and Settings\n94\Start Menu\Programs\Startup\
MagicDisc.lnk - C:\Program Files\MagicDisc\MagicDisc.exe [2007-12-29 23:29:43]
Xfire.lnk - C:\Program Files\Xfire\xfire.exe [2007-12-04 20:25:00]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Belkin Wireless Utility.lnk - C:\Program Files\Belkin\PCI F5D7000\Wireless Utility\Belkinwcui.exe [2005-08-18 17:09:58]
BlackICE PC Protection.lnk - C:\Program Files\ISS\BlackICE\blackice.exe [2007-12-28 23:26:49]
Nostromo Loadout Manager.lnk - C:\WINDOWS\Installer\{548C7B77-8B04-427E-ACD0-D0E6E6E59BCF}\NewShortcut2_548C7B778B04427EACD0D0E6E6E59BCF.exe [2007-12-29 00:59:01]
R1 easdrv;easdrv;C:\WINDOWS\system32\DRIVERS\easdrv.sys [2007-11-08 16:10]
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-11-08 16:17]
R2 eamon;EAMON;C:\WINDOWS\system32\DRIVERS\eamon.sys [2007-11-08 16:09]
R2 ekrn;Eset Service;"C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe" [2007-11-08 16:15]
R3 bcgame;Nostromo HID Device Minidriver;C:\WINDOWS\system32\drivers\bcgame.sys [2007-08-14 10:57]
R3 BLKWGD;Belkin Wireless G Desktop Card Service;C:\WINDOWS\system32\DRIVERS\BLKWGD.sys [2005-06-01 21:37]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2006-12-20 07:00]
R3 UsbFltr;Razer Copperhead Driver;C:\WINDOWS\system32\drivers\copperhd.sys [2005-11-02 10:54]
R3 wlanndi5;wlanndi5 NDIS Protocol Driver;C:\WINDOWS\system32\wlanndi5.SYS [2004-04-21 17:51]
S3 EhttpSrv;Eset HTTP Server;"C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe" [2007-11-08 16:20]
S3 RapDrv;RapDrv;C:\WINDOWS\system32\drivers\RapDrv.sys [2003-10-24 16:57]
S3 RapFile;RapFile;C:\WINDOWS\system32\drivers\RapFile.sys [2003-02-25 19:26]
S3 RapNet;RapNet;C:\WINDOWS\system32\drivers\RapNet.sys [2003-02-25 19:26]
S4 black;black;C:\WINDOWS\system32\drivers\BlackDrv.sys [2005-03-30 10:40]
.
i can clearly see the infected files in this log the .EXE
pmnnm.exe is what i see a lot
i think combo fix got it but now that i reboot it says cant find temp image over and over…and i have to reintall nod 32 everytime
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:03, on 2008-01-01
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\ISS\BlackICE\blackd.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Belkin\PCI F5D7000\Wireless Utility\Belkinwcui.exe
C:\Program Files\ISS\BlackICE\blackice.exe
C:\Program Files\Belkin\Nostromo\nost_LM.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\Program Files\Xfire\xfire.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Documents and Settings\n94\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [StartupMonitor] "C:\Program Files\SNP Software\StartupMonitor\StartupMonitor.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [CmPCIaudio] RunDll32 CMICNFG3.CPL,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Copperhead] C:\Program Files\Razer\Copperhead\razerhid.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Belkin Wireless Utility.lnk = C:\Program Files\Belkin\PCI F5D7000\Wireless Utility\Belkinwcui.exe
O4 - Global Startup: BlackICE PC Protection.lnk = C:\Program Files\ISS\BlackICE\blackice.exe
O4 - Global Startup: Nostromo Loadout Manager.lnk = ?
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u…can_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1198906380356
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1198906371685
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\blackd.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\rapapp.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
–
End of file - 6906 bytes
ComboFix 07-12-31.4 - n94 2008-01-01 12:36:23.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.591 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\_000005_.tmp.dll
C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\_000007_.tmp.dll
C:\WINDOWS\system32\csnbbqts.ini
C:\WINDOWS\system32\mnnmp.ini
C:\WINDOWS\system32\mnnmp.ini2
C:\WINDOWS\system32\pmnnm.dll
C:\WINDOWS\system32\rqrrsqr.dll
C:\WINDOWS\system32\stqbbnsc.dll
C:\WINDOWS\system32\vpyximlw.dll
C:\WINDOWS\system32\wlmixypv.ini
C:\WINDOWS\system32\xwajeway.dll
.
((((((((((((((((((((((((( Files Created from 2007-12-01 to 2008-01-01 )))))))))))))))))))))))))))))))
.
2008-01-01 12:40 . 2008-01-01 12:40 d——– C:\WINDOWS\system32\xircom
2008-01-01 12:40 . 2008-01-01 12:40 d——– C:\Program Files\microsoft frontpage
2008-01-01 12:34 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-01 12:33 . 2008-01-01 12:33 d——– C:\Program Files\Yahoo!
2008-01-01 12:33 . 2008-01-01 12:33 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-01-01 12:32 . 2008-01-01 12:33 d——– C:\Program Files\CCleaner
2008-01-01 04:31 . 2008-01-01 12:36 d——– C:\Program Files\Trojan Remover
2008-01-01 04:31 . 2008-01-01 04:31 d——– C:\Documents and Settings\n94\Application Data\Simply Super Software
2008-01-01 04:31 . 2008-01-01 04:31 d——– C:\Documents and Settings\All Users\Application Data\Simply Super Software
2008-01-01 04:31 . 2006-05-25 14:52 162,304 –a—— C:\WINDOWS\system32\ztvunrar36.dll
2008-01-01 04:31 . 2003-02-02 19:06 153,088 –a—— C:\WINDOWS\system32\UNRAR3.dll
2008-01-01 04:31 . 2005-08-26 00:50 77,312 –a—— C:\WINDOWS\system32\ztvunace26.dll
2008-01-01 04:31 . 2002-03-06 00:00 75,264 –a—— C:\WINDOWS\system32\unacev2.dll
2008-01-01 04:31 . 2006-06-19 12:01 69,632 –a—— C:\WINDOWS\system32\ztvcabinet.dll
2008-01-01 04:30 . 1999-12-12 11:01 44,032 –a—— C:\WINDOWS\system32\CTSVCCDA.EXE
2008-01-01 04:30 . 1999-11-17 11:00 25,088 –a—— C:\WINDOWS\system32\CTSVCCTL.EXE
2008-01-01 04:26 . 2008-01-01 04:26 d——– C:\Program Files\uTorrent
2008-01-01 04:26 . 2008-01-01 04:35 d——– C:\Program Files\Creative
2008-01-01 04:26 . 2008-01-01 04:38 d——– C:\Documents and Settings\n94\Application Data\uTorrent
2008-01-01 04:11 . 2008-01-01 04:12 d——– C:\Documents and Settings\n94\Application Data\PrevxCSI
2008-01-01 04:11 . 2008-01-01 04:11 d——– C:\Documents and Settings\All Users\Application Data\Prevx
2008-01-01 04:07 . 2008-01-01 04:36 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-01 02:28 . 2008-01-01 02:28 d——– C:\Documents and Settings\n94\Shared
2008-01-01 02:28 . 2008-01-01 02:35 d——– C:\Documents and Settings\n94\Incomplete
2008-01-01 02:27 . 2008-01-01 02:35 d——– C:\Documents and Settings\n94\Application Data\LimeWire
2008-01-01 02:26 . 2008-01-01 02:26 d——– C:\Program Files\Java
2008-01-01 02:26 . 2007-07-12 02:22 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-01-01 02:25 . 2008-01-01 02:25 d——– C:\Program Files\Common Files\Java
2008-01-01 02:24 . 2008-01-01 02:26 d——– C:\Program Files\LimeWire
2008-01-01 02:15 . 2008-01-01 02:36 d——– C:\Documents and Settings\n94\Application Data\SoundSpectrum
2008-01-01 01:35 . 2008-01-01 01:36 d——– C:\Program Files\Paint.NET
2008-01-01 01:08 . 2008-01-01 01:08 d——– C:\Program Files\SoundSpectrum
2008-01-01 01:08 . 2008-01-01 04:49 69,776 –ahs—- C:\WINDOWS\system32\mnnmp.ini2.ren
2008-01-01 01:08 . 2008-01-01 04:51 69,776 –ahs—- C:\WINDOWS\system32\mnnmp.ini.ren
2008-01-01 01:08 . 2008-01-01 01:08 1 –a—— C:\WINDOWS\system32\pmnnm.exe
2008-01-01 01:04 . 2008-01-01 12:36 d——– C:\Program Files\Winamp
2008-01-01 01:04 . 2008-01-01 02:36 d——– C:\Documents and Settings\n94\Application Data\Winamp
2007-12-31 01:37 . 2007-12-31 01:37 d——– C:\Documents and Settings\n94\Application Data\vlc
2007-12-31 01:32 . 2007-12-31 01:32 d——– C:\Program Files\VideoLAN
2007-12-31 01:24 . 2007-12-31 01:24 d——– C:\Program Files\THQ
2007-12-31 00:22 . 2007-12-31 00:22 d——– C:\Documents and Settings\LocalService\Application Data\Xfire
2007-12-30 23:32 . 2007-12-30 23:32 d——– C:\Documents and Settings\n94\Application Data\CyberLink
2007-12-30 23:26 . 2007-12-30 23:26 d——– C:\Documents and Settings\All Users\Application Data\CyberLink
2007-12-30 23:25 . 2007-12-30 23:25 d——– C:\Program Files\CyberLink
2007-12-30 23:25 . 2003-03-18 20:14 499,712 –a—— C:\WINDOWS\system32\msvcp71.dll
2007-12-30 23:25 . 2003-02-21 04:42 348,160 –a—— C:\WINDOWS\system32\msvcr71.dll
2007-12-30 23:25 . 2001-03-08 18:30 24,064 –a—— C:\WINDOWS\system32\msxml3a.dll
2007-12-30 23:17 . 2007-12-30 23:17 d——– C:\Documents and Settings\NetworkService\Application Data\Xfire
2007-12-30 23:14 . 2007-12-30 23:14 d——– C:\Program Files\Razer
2007-12-30 23:14 . 2007-12-30 23:14 d——– C:\Documents and Settings\n94\Application Data\InstallShield
2007-12-30 23:14 . 2005-11-10 09:15 69,632 –a—— C:\WINDOWS\system32\copperhd.cpl
2007-12-30 23:14 . 2005-12-21 11:23 14,592 –a—— C:\WINDOWS\system32\drivers\USBICP.sys
2007-12-29 23:31 . 2007-12-29 23:31 d——– C:\Program Files\MagicISO
2007-12-29 23:29 . 2007-12-29 23:30 d——– C:\Program Files\MagicDisc
2007-12-29 23:29 . 2007-09-05 01:46 92,544 –a—— C:\WINDOWS\system32\drivers\mcdbus.sys
2007-12-29 22:27 . 2007-12-29 22:27 1,158 –a—— C:\WINDOWS\mozver.dat
2007-12-29 05:09 . 2007-12-29 05:09 0 –a—— C:\WINDOWS\nsreg.dat
2007-12-29 04:08 . 2007-12-30 02:48 d——– C:\Documents and Settings\n94\Contacts
2007-12-29 04:01 . 2004-08-03 23:08 25,600 –a—— C:\WINDOWS\system32\drivers\usbser.sys
2007-12-29 03:34 . 2007-12-29 03:41 d——– C:\Program Files\Windows Live
2007-12-29 03:34 . 2007-12-29 03:37 d–hsc— C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-29 03:34 . 2007-12-29 03:34 d——– C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-29 02:17 . 2007-05-16 16:45 1,124,720 –a—— C:\WINDOWS\system32\D3DCompiler_34.dll
2007-12-29 02:17 . 2007-05-16 16:45 443,752 –a—— C:\WINDOWS\system32\d3dx10_34.dll
2007-12-29 02:17 . 2007-05-31 19:30 266,088 –a—— C:\WINDOWS\system32\xactengine2_8.dll
2007-12-29 02:17 . 2007-05-31 19:29 18,280 –a—— C:\WINDOWS\system32\x3daudio1_2.dll
2007-12-29 01:53 . 2008-01-01 02:38 107,832 –a—— C:\WINDOWS\system32\PnkBstrB.exe
2007-12-29 01:53 . 2007-12-29 04:22 66,872 –a—— C:\WINDOWS\system32\PnkBstrA.exe
2007-12-29 01:53 . 2008-01-01 02:38 22,328 –a—— C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-12-29 01:53 . 2007-12-29 01:53 22,328 –a—— C:\Documents and Settings\n94\Application Data\PnkBstrK.sys
2007-12-29 01:53 . 2007-12-29 01:53 319 –a—— C:\WINDOWS\game.ini
2007-12-29 01:39 . 2007-12-29 01:39 d——– C:\Program Files\Activision
2007-12-29 01:35 . 2007-12-29 01:35 d–hs—- C:\WINDOWS\ftpcache
2007-12-29 00:59 . 2007-12-29 03:40 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-12-29 00:59 . 2007-12-29 00:59 d——– C:\Documents and Settings\n94\Application Data\Belkin
2007-12-29 00:59 . 2007-08-14 10:57 240,112 -ra—— C:\WINDOWS\system32\bgcpsp2.dll
2007-12-29 00:59 . 2007-08-14 10:57 23,040 -ra—— C:\WINDOWS\system32\drivers\bcgame.sys
2007-12-29 00:39 . 2007-12-29 00:39 d——– C:\Program Files\dayam NFO Viewer
2007-12-29 00:38 . 2007-12-29 00:38 d——– C:\Program Files\SmartFTP Client 2.5 Setup Files
2007-12-29 00:38 . 2007-12-29 00:38 d——– C:\Program Files\SmartFTP Client
2007-12-29 00:38 . 2007-12-29 00:38 d——– C:\Documents and Settings\n94\Application Data\SmartFTP
2007-12-29 00:30 . 2007-12-29 00:30 d——– C:\Program Files\Ventrilo
2007-12-29 00:30 . 2007-12-29 00:30 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-12-29 00:30 . 2008-01-01 00:37 d——– C:\Documents and Settings\n94\Application Data\Ventrilo
2007-12-29 00:23 . 2007-12-29 00:23 d——– C:\WINDOWS\nview
2007-12-29 00:23 . 2007-12-05 02:53 356,352 –a—— C:\WINDOWS\system32\NVUNINST.EXE
2007-12-29 00:23 . 2007-12-05 01:41 356,352 –a—— C:\WINDOWS\system32\nvudisp.exe
2007-12-29 00:23 . 2007-12-29 00:27 163,353 –a—— C:\WINDOWS\system32\nvapps.xml
2007-12-29 00:23 . 2007-12-05 01:41 17,737 –a—— C:\WINDOWS\system32\nvdisp.nvu
2007-12-29 00:22 . 2007-12-29 00:22 d——– C:\NVIDIA
2007-12-29 00:21 . 2006-06-14 03:17 82,944 –a—— C:\WINDOWS\system32\drivers\wdmaud.sys
2007-12-29 00:21 . 2004-08-03 23:07 52,864 –a—— C:\WINDOWS\system32\drivers\DMusic.sys
2007-12-29 00:21 . 2006-06-14 02:50 6,272 –a—— C:\WINDOWS\system32\drivers\splitter.sys
2007-12-29 00:21 . 2007-12-29 22:52 635 –a—— C:\WINDOWS\system\Cmicnfg3.ini
2007-12-29 00:20 . 2007-12-29 00:20 d——– C:\Program Files\Xtreme Sound PCI
2007-12-29 00:19 . 2007-12-29 00:19 d——– C:\Program Files\Xtreme Sound Driver Setup
2007-12-29 00:08 . 2007-12-31 00:22 d——– C:\Program Files\Xfire
2007-12-29 00:08 . 2007-12-31 05:10 d——– C:\Documents and Settings\n94\Application Data\Xfire
2007-12-29 00:07 . 2007-12-29 00:07 d—s—- C:\Program Files\HLSW
2007-12-29 00:07 . 2007-12-30 23:19 d——– C:\Documents and Settings\n94\Application Data\HLSW
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-01 18:36 ——— d—–w C:\Program Files\Steam
2008-01-01 10:35 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-29 06:59 ——— d—–w C:\Program Files\Belkin
2007-12-29 06:19 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-12-29 05:59 ——— d—–w C:\Program Files\MSXML 6.0
2007-12-29 05:59 ——— d—–w C:\Program Files\MSXML 4.0
2007-12-29 05:58 ——— d—–w C:\Program Files\Windows Media Connect 2
2007-12-29 05:57 ——— d—–w C:\Program Files\Logitech
2007-12-29 05:57 ——— d—–w C:\Documents and Settings\All Users\Application Data\Logitech
2007-12-29 05:29 17,801 —-a-w C:\WINDOWS\system32\drivers\AegisP.sys
2007-12-29 05:26 10 —-a-w C:\WINDOWS\system32\drivers\tmbi.sys
2007-12-29 05:26 ——— d—–w C:\Program Files\ISS
2007-12-29 05:24 61,440 —-a-w C:\WINDOWS\keygen.dll
2007-12-29 05:17 ——— d—–w C:\Documents and Settings\All Users\Application Data\ESET
2007-12-29 05:04 ——— d—–w C:\Program Files\SNP Software
2007-12-05 07:41 7,435,392 —-a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-08 22:17 30,728 —-a-w C:\WINDOWS\system32\drivers\epfwtdir.sys
2007-11-08 22:10 27,656 —-a-w C:\WINDOWS\system32\drivers\easdrv.sys
2007-11-08 22:09 33,800 —-a-w C:\WINDOWS\system32\drivers\eamon.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\steam\steam.exe" [2008-01-01 12:36 1]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-01-01 12:36 1]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2008-01-01 12:36 1]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-01 12:36 1]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2008-01-01 12:36 1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartupMonitor"="C:\Program Files\SNP Software\StartupMonitor\StartupMonitor.exe" [2008-01-01 12:36 1]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-01-01 12:36 1]
"Launch LCDMon"="C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2008-01-01 12:36 1]
"Launch LGDCore"="C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2008-01-01 12:36 1]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2008-01-01 12:36 1]
"CmPCIaudio"="CMICNFG3.CPL" []
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"Copperhead"="C:\Program Files\Razer\Copperhead\razerhid.exe" [2008-01-01 12:36 1]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2008-01-01 12:36 1]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2008-01-01 12:36 1]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-01 12:36 1]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2008-01-01 12:36 1]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-01-01 12:36 1]
C:\Documents and Settings\n94\Start Menu\Programs\Startup\
MagicDisc.lnk - C:\Program Files\MagicDisc\MagicDisc.exe [2007-12-29 23:29:43]
Xfire.lnk - C:\Program Files\Xfire\xfire.exe [2007-12-04 20:25:00]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Belkin Wireless Utility.lnk - C:\Program Files\Belkin\PCI F5D7000\Wireless Utility\Belkinwcui.exe [2005-08-18 17:09:58]
BlackICE PC Protection.lnk - C:\Program Files\ISS\BlackICE\blackice.exe [2007-12-28 23:26:49]
Nostromo Loadout Manager.lnk - C:\WINDOWS\Installer\{548C7B77-8B04-427E-ACD0-D0E6E6E59BCF}\NewShortcut2_548C7B778B04427EACD0D0E6E6E59BCF.exe [2007-12-29 00:59:01]
R1 easdrv;easdrv;C:\WINDOWS\system32\DRIVERS\easdrv.sys [2007-11-08 16:10]
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-11-08 16:17]
R2 eamon;EAMON;C:\WINDOWS\system32\DRIVERS\eamon.sys [2007-11-08 16:09]
R2 ekrn;Eset Service;"C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe" [2007-11-08 16:15]
R3 bcgame;Nostromo HID Device Minidriver;C:\WINDOWS\system32\drivers\bcgame.sys [2007-08-14 10:57]
R3 BLKWGD;Belkin Wireless G Desktop Card Service;C:\WINDOWS\system32\DRIVERS\BLKWGD.sys [2005-06-01 21:37]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2006-12-20 07:00]
R3 UsbFltr;Razer Copperhead Driver;C:\WINDOWS\system32\drivers\copperhd.sys [2005-11-02 10:54]
R3 wlanndi5;wlanndi5 NDIS Protocol Driver;C:\WINDOWS\system32\wlanndi5.SYS [2004-04-21 17:51]
S3 EhttpSrv;Eset HTTP Server;"C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe" [2007-11-08 16:20]
S3 RapDrv;RapDrv;C:\WINDOWS\system32\drivers\RapDrv.sys [2003-10-24 16:57]
S3 RapFile;RapFile;C:\WINDOWS\system32\drivers\RapFile.sys [2003-02-25 19:26]
S3 RapNet;RapNet;C:\WINDOWS\system32\drivers\RapNet.sys [2003-02-25 19:26]
S4 black;black;C:\WINDOWS\system32\drivers\BlackDrv.sys [2005-03-30 10:40]
.