steve207
Topic Starter
My computer is running wierd. I got this log from ComboFix. Any help would be greatly appreciated.
ComboFix 08-01-10.2 - Owner 2008-01-10 15:37:08.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.576 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\ShoppingReport
C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\ShoppingReport\cs\Config.xml
C:\Program Files\akl
C:\Program Files\akl\akl.dll
C:\Program Files\akl\akl.exe
C:\Program Files\akl\curlog.htm
C:\Program Files\akl\keylog.txt
C:\Program Files\akl\uninstall.exe
C:\Program Files\akl\unsetup.dat
C:\Program Files\akl\unsetup.exe
C:\Program Files\amsys
C:\Program Files\amsys\awmsg.dat
C:\Program Files\amsys\mfc42.dll
C:\Program Files\amsys\msvcrt.dll
C:\Program Files\amsys\unins000.dat
C:\Program Files\amsys\unis000.exe
C:\Program Files\amsys\winam.dat
C:\Program Files\p2pnetworks
C:\Program Files\p2pnetworks\amp2pl.exe^
C:\WINDOWS\absolute key logger.lnk
C:\WINDOWS\aconti.exe
C:\WINDOWS\aconti.log
C:\WINDOWS\acontidialer.txt
C:\WINDOWS\adbar.dll
C:\WINDOWS\cbinst$.exe
C:\WINDOWS\daxtime.dll
C:\WINDOWS\default.htm
C:\WINDOWS\dp0.dll
C:\WINDOWS\eventlowg.dll
C:\WINDOWS\fhfmm-Uninstaller.exe
C:\WINDOWS\fhfmm.exe
C:\WINDOWS\flt.dll
C:\WINDOWS\jd2002.dll
C:\WINDOWS\kkcomp$.exe
C:\WINDOWS\kkcomp.exe
C:\WINDOWS\liqad$.exe
C:\WINDOWS\liqad.exe
C:\WINDOWS\liqui-Uninstaller.exe
C:\WINDOWS\liqui.exe
C:\WINDOWS\ngd.dll
C:\WINDOWS\pbar.dll
C:\WINDOWS\spredirect.dll
C:\WINDOWS\system32\ace16win.dll
C:\WINDOWS\system32\acespy
C:\WINDOWS\system32\acespy\__acelog.ndx
C:\WINDOWS\system32\acespy\systune.exe
C:\WINDOWS\system32\din.ip
C:\WINDOWS\system32\drivers\bg_bg.gif
C:\WINDOWS\system32\drivers\blank.gif
C:\WINDOWS\system32\drivers\box_1.gif
C:\WINDOWS\system32\drivers\box_2.gif
C:\WINDOWS\system32\drivers\box_3.gif
C:\WINDOWS\system32\drivers\button_buynow.gif
C:\WINDOWS\system32\drivers\button_freescan.gif
C:\WINDOWS\system32\drivers\cell_bg.gif
C:\WINDOWS\system32\drivers\cell_footer.gif
C:\WINDOWS\system32\drivers\cell_header_block.gif
C:\WINDOWS\system32\drivers\cell_header_remove.gif
C:\WINDOWS\system32\drivers\cell_header_scan.gif
C:\WINDOWS\system32\drivers\close_ico.gif
C:\WINDOWS\system32\drivers\download_box.gif
C:\WINDOWS\system32\drivers\download_btn.jpg
C:\WINDOWS\system32\drivers\download_now_btn.gif
C:\WINDOWS\system32\drivers\footer_back.jpg
C:\WINDOWS\system32\drivers\header_1.gif
C:\WINDOWS\system32\drivers\header_2.gif
C:\WINDOWS\system32\drivers\header_3.gif
C:\WINDOWS\system32\drivers\header_4.gif
C:\WINDOWS\system32\drivers\header_red_bg.gif
C:\WINDOWS\system32\drivers\header_red_free_scan.gif
C:\WINDOWS\system32\drivers\header_red_free_scan_bg.gif
C:\WINDOWS\system32\drivers\header_red_protect_your_pc.gif
C:\WINDOWS\system32\drivers\icon_warning_big.gif
C:\WINDOWS\system32\drivers\infected.gif
C:\WINDOWS\system32\drivers\main_back.gif
C:\WINDOWS\system32\drivers\perfect_cleaner_box.jpg
C:\WINDOWS\system32\drivers\product_1_header.gif
C:\WINDOWS\system32\drivers\product_1_name_small.gif
C:\WINDOWS\system32\drivers\product_2_header.gif
C:\WINDOWS\system32\drivers\product_2_name_small.gif
C:\WINDOWS\system32\drivers\product_3_header.gif
C:\WINDOWS\system32\drivers\product_3_name_small.gif
C:\WINDOWS\system32\drivers\product_features.gif
C:\WINDOWS\system32\drivers\rating.gif
C:\WINDOWS\system32\drivers\remove_spyware_header.gif
C:\WINDOWS\system32\drivers\screenshot.jpg
C:\WINDOWS\system32\drivers\sep_hor.gif
C:\WINDOWS\system32\drivers\sep_vert.gif
C:\WINDOWS\system32\drivers\shadow.jpg
C:\WINDOWS\system32\drivers\shadow_bg.gif
C:\WINDOWS\system32\drivers\spacer.gif
C:\WINDOWS\system32\drivers\spy_away_box.jpg
C:\WINDOWS\system32\drivers\spyware_detected.gif
C:\WINDOWS\system32\drivers\star.gif
C:\WINDOWS\system32\drivers\star_gray.gif
C:\WINDOWS\system32\drivers\star_gray_small.gif
C:\WINDOWS\system32\drivers\star_small.gif
C:\WINDOWS\system32\drivers\style.css
C:\WINDOWS\system32\drivers\v.gif
C:\WINDOWS\system32\drivers\warning_ico.gif
C:\WINDOWS\system32\drivers\warning_icon.gif
C:\WINDOWS\system32\drivers\win_logo.gif
C:\WINDOWS\system32\drivers\x.gif
C:\WINDOWS\system32\drivers\yellow_warning_ico.gif
C:\WINDOWS\system32\ESHOPEE.exe
C:\WINDOWS\system32\gtv_sd.bin
C:\WINDOWS\system32\msole32.exe
C:\WINDOWS\system32\oembios32.dll
C:\WINDOWS\system32\stfv.bin
C:\WINDOWS\system32\sznf.ascii
C:\WINDOWS\xadbrk.exe
C:\WINDOWS\xadbrk_.exe
C:\WINDOWS\xxxvideo.exe
.
((((((((((((((((((((((((( Files Created from 2007-12-10 to 2008-01-10 )))))))))))))))))))))))))))))))
.
2008-01-10 15:34 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-10 15:01 . 2008-01-10 15:02 d——– C:\WINDOWS\ERUNT
2008-01-10 12:24 . 2008-01-10 12:24 d—-c— C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\InstallShield
2008-01-10 12:23 . 2008-01-10 12:23 d—-c— C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\ATI
2008-01-03 11:46 . 2008-01-03 11:46 d—-c— C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
2007-12-24 19:13 . 2008-01-02 20:33 d——– C:\Program Files\Guild Wars
2007-12-24 14:59 . 2007-12-24 14:59 d—-c— C:\3d3e9a388af8f1745b76529800ee
2007-12-21 17:34 . 2006-01-26 13:21 34,686 –a—— C:\WINDOWS\system32\drivers\Capt905c.sys
2007-12-21 17:34 . 2006-01-26 13:21 24,569 –a—— C:\WINDOWS\system32\drivers\Camd905c.sys
2007-12-20 20:49 . 2007-12-20 20:49 d——– C:\Program Files\Virtools
2007-12-19 11:54 . 2007-12-19 19:21 25,088 –a—— C:\WINDOWS\system32\winsckdo.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-02 23:08 ——— d—–w C:\Program Files\Motorola Phone Tools
2008-01-02 23:05 ——— dc—-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\Road Runner
2008-01-02 23:05 ——— dc—-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\Leadertech
2008-01-02 23:05 ——— dc—-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\InterVideo
2008-01-02 23:05 ——— dc—-w C:\Documents and Settings\Kat\Application Data\Leadertech
2008-01-02 23:05 ——— dc—-w C:\Documents and Settings\All Users\Application Data\Road Runner
2008-01-02 23:05 ——— dc—-w C:\Documents and Settings\All Users\Application Data\CA
2008-01-02 23:05 ——— d—–w C:\Program Files\Yahoo!
2008-01-02 22:58 ——— d—–w C:\Program Files\Windows Installer Clean Up
2008-01-02 22:54 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-02 22:54 ——— d—–w C:\Program Files\Support.com
2008-01-02 22:54 ——— d—–w C:\Program Files\QuickTime
2008-01-02 22:54 ——— d—–w C:\Program Files\MSN Messenger
2008-01-02 22:54 ——— d—–w C:\Program Files\HP Instant Support
2008-01-02 22:53 ——— dc—-w C:\Documents and Settings\All Users\Application Data\yahoo!
2008-01-02 22:53 ——— dc—-w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-02 22:53 ——— dc—-w C:\Documents and Settings\All Users\Application Data\BVRP Software
2007-12-24 20:07 ——— d—–w C:\Program Files\Avanquest update
2007-12-07 20:44 24,192 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\usbsermptxp.sys
2007-12-07 20:44 22,768 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\usbsermpt.sys
2007-12-07 20:44 22,768 —-a-w C:\WINDOWS\system32\drivers\usbsermpt.sys
2007-12-03 20:56 69,632 —-a-w C:\WINDOWS\system32\realbap1.dll
2007-12-03 20:56 45,568 —-a-w C:\WINDOWS\system32\realbsf1.dll
2007-12-03 14:35 ——— d—–w C:\Program Files\Motorola
2007-12-01 19:05 3,567 —-a-w C:\WINDOWS\system32\drivers\PortTalk.sys
2007-12-01 18:03 ——— d—–w C:\Program Files\Common Files\Motorola Shared
2007-11-15 18:55 ——— d—–w C:\Program Files\Java
2007-11-14 22:08 92,064 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmmdm.sys
2007-11-14 22:08 9,232 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmmdfl.sys
2007-11-14 22:08 79,328 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmserd.sys
2007-11-14 22:08 66,656 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmbus.sys
2007-11-14 22:08 6,208 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmcmnt.sys
2007-11-14 22:08 5,936 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmwhnt.sys
2007-11-14 22:08 4,048 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmcr.sys
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-11 21:53 ——— dc—-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\VCOM
2007-11-11 21:53 ——— dc—-w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-11 21:53 ——— dc—-w C:\Documents and Settings\Administrator\Application Data\VCOM
2007-11-07 09:26 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 22:40 222,720 —-a-w C:\WINDOWS\system32\wmasf.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20 866584]
"Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-10-29 10:17 135168]
"snpstd"="C:\WINDOWS\vsnpstd.exe" [2003-12-31 16:39 40960]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2003-11-03 19:50 221184]
"QOELOADER"="C:\Program Files\CA\eTrust EZ Armor\eTrust Anti-Spam\QSP-2.1.215.5\QOELoader.exe" [2007-01-11 22:03 6656]
"OneCareUI"="C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" [ ]
"NWEReboot"="" []
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 19:04 52736]
"CAVRID"="C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe" [2007-02-11 22:52 185456]
"CaAvTray"="C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe" [2007-02-11 22:52 230512]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-11-13 21:10 335872]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 09:06 88363 C:\WINDOWS\AGRSMMSG.exe]
"medicsp2"="C:\Program Files\twc\medicsp2\bin\sprtcmd.exe" [2007-03-07 10:53 198184]
"VirusScannerPro"="C:\PROGRA~1\VCOM\Fix-It\MemCheck.exe" [2007-01-29 15:02 62976]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-03-05 10:10 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [ ]
R2 Fix-It Task Manager;Fix-It Task Manager;C:\PROGRA~1\VCOM\Fix-It\mxtask.exe [2007-01-29 15:02]
R2 sprtsvc_medicsp2;SupportSoft Sprocket Service (medicsp2);C:\Program Files\twc\medicsp2\bin\sprtsvc.exe /service []
R3 mxDisk;mxDisk;C:\PROGRA~1\VCOM\Fix-It\mxDisk.sys [2007-01-29 12:01]
S2 UMAXPCLS;Print Port Scanner Driver;C:\WINDOWS\system32\DRIVERS\umaxpcls.sys [2001-08-17 13:58]
S3 CCCP106;CIF USB Camera (2110A);C:\WINDOWS\system32\DRIVERS\cccp106.sys [2003-04-09 10:17]
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
"2007-04-15 14:11:23 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job"
- C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1
"2008-01-10 20:12:35 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-10 15:41:32
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-10 15:43:06
ComboFix-quarantined-files.txt 2008-01-10 20:42:45
.
2008-01-09 08:02:47 — E O F —
ComboFix 08-01-10.2 - Owner 2008-01-10 15:37:08.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.576 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\ShoppingReport
C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\ShoppingReport\cs\Config.xml
C:\Program Files\akl
C:\Program Files\akl\akl.dll
C:\Program Files\akl\akl.exe
C:\Program Files\akl\curlog.htm
C:\Program Files\akl\keylog.txt
C:\Program Files\akl\uninstall.exe
C:\Program Files\akl\unsetup.dat
C:\Program Files\akl\unsetup.exe
C:\Program Files\amsys
C:\Program Files\amsys\awmsg.dat
C:\Program Files\amsys\mfc42.dll
C:\Program Files\amsys\msvcrt.dll
C:\Program Files\amsys\unins000.dat
C:\Program Files\amsys\unis000.exe
C:\Program Files\amsys\winam.dat
C:\Program Files\p2pnetworks
C:\Program Files\p2pnetworks\amp2pl.exe^
C:\WINDOWS\absolute key logger.lnk
C:\WINDOWS\aconti.exe
C:\WINDOWS\aconti.log
C:\WINDOWS\acontidialer.txt
C:\WINDOWS\adbar.dll
C:\WINDOWS\cbinst$.exe
C:\WINDOWS\daxtime.dll
C:\WINDOWS\default.htm
C:\WINDOWS\dp0.dll
C:\WINDOWS\eventlowg.dll
C:\WINDOWS\fhfmm-Uninstaller.exe
C:\WINDOWS\fhfmm.exe
C:\WINDOWS\flt.dll
C:\WINDOWS\jd2002.dll
C:\WINDOWS\kkcomp$.exe
C:\WINDOWS\kkcomp.exe
C:\WINDOWS\liqad$.exe
C:\WINDOWS\liqad.exe
C:\WINDOWS\liqui-Uninstaller.exe
C:\WINDOWS\liqui.exe
C:\WINDOWS\ngd.dll
C:\WINDOWS\pbar.dll
C:\WINDOWS\spredirect.dll
C:\WINDOWS\system32\ace16win.dll
C:\WINDOWS\system32\acespy
C:\WINDOWS\system32\acespy\__acelog.ndx
C:\WINDOWS\system32\acespy\systune.exe
C:\WINDOWS\system32\din.ip
C:\WINDOWS\system32\drivers\bg_bg.gif
C:\WINDOWS\system32\drivers\blank.gif
C:\WINDOWS\system32\drivers\box_1.gif
C:\WINDOWS\system32\drivers\box_2.gif
C:\WINDOWS\system32\drivers\box_3.gif
C:\WINDOWS\system32\drivers\button_buynow.gif
C:\WINDOWS\system32\drivers\button_freescan.gif
C:\WINDOWS\system32\drivers\cell_bg.gif
C:\WINDOWS\system32\drivers\cell_footer.gif
C:\WINDOWS\system32\drivers\cell_header_block.gif
C:\WINDOWS\system32\drivers\cell_header_remove.gif
C:\WINDOWS\system32\drivers\cell_header_scan.gif
C:\WINDOWS\system32\drivers\close_ico.gif
C:\WINDOWS\system32\drivers\download_box.gif
C:\WINDOWS\system32\drivers\download_btn.jpg
C:\WINDOWS\system32\drivers\download_now_btn.gif
C:\WINDOWS\system32\drivers\footer_back.jpg
C:\WINDOWS\system32\drivers\header_1.gif
C:\WINDOWS\system32\drivers\header_2.gif
C:\WINDOWS\system32\drivers\header_3.gif
C:\WINDOWS\system32\drivers\header_4.gif
C:\WINDOWS\system32\drivers\header_red_bg.gif
C:\WINDOWS\system32\drivers\header_red_free_scan.gif
C:\WINDOWS\system32\drivers\header_red_free_scan_bg.gif
C:\WINDOWS\system32\drivers\header_red_protect_your_pc.gif
C:\WINDOWS\system32\drivers\icon_warning_big.gif
C:\WINDOWS\system32\drivers\infected.gif
C:\WINDOWS\system32\drivers\main_back.gif
C:\WINDOWS\system32\drivers\perfect_cleaner_box.jpg
C:\WINDOWS\system32\drivers\product_1_header.gif
C:\WINDOWS\system32\drivers\product_1_name_small.gif
C:\WINDOWS\system32\drivers\product_2_header.gif
C:\WINDOWS\system32\drivers\product_2_name_small.gif
C:\WINDOWS\system32\drivers\product_3_header.gif
C:\WINDOWS\system32\drivers\product_3_name_small.gif
C:\WINDOWS\system32\drivers\product_features.gif
C:\WINDOWS\system32\drivers\rating.gif
C:\WINDOWS\system32\drivers\remove_spyware_header.gif
C:\WINDOWS\system32\drivers\screenshot.jpg
C:\WINDOWS\system32\drivers\sep_hor.gif
C:\WINDOWS\system32\drivers\sep_vert.gif
C:\WINDOWS\system32\drivers\shadow.jpg
C:\WINDOWS\system32\drivers\shadow_bg.gif
C:\WINDOWS\system32\drivers\spacer.gif
C:\WINDOWS\system32\drivers\spy_away_box.jpg
C:\WINDOWS\system32\drivers\spyware_detected.gif
C:\WINDOWS\system32\drivers\star.gif
C:\WINDOWS\system32\drivers\star_gray.gif
C:\WINDOWS\system32\drivers\star_gray_small.gif
C:\WINDOWS\system32\drivers\star_small.gif
C:\WINDOWS\system32\drivers\style.css
C:\WINDOWS\system32\drivers\v.gif
C:\WINDOWS\system32\drivers\warning_ico.gif
C:\WINDOWS\system32\drivers\warning_icon.gif
C:\WINDOWS\system32\drivers\win_logo.gif
C:\WINDOWS\system32\drivers\x.gif
C:\WINDOWS\system32\drivers\yellow_warning_ico.gif
C:\WINDOWS\system32\ESHOPEE.exe
C:\WINDOWS\system32\gtv_sd.bin
C:\WINDOWS\system32\msole32.exe
C:\WINDOWS\system32\oembios32.dll
C:\WINDOWS\system32\stfv.bin
C:\WINDOWS\system32\sznf.ascii
C:\WINDOWS\xadbrk.exe
C:\WINDOWS\xadbrk_.exe
C:\WINDOWS\xxxvideo.exe
.
((((((((((((((((((((((((( Files Created from 2007-12-10 to 2008-01-10 )))))))))))))))))))))))))))))))
.
2008-01-10 15:34 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-10 15:01 . 2008-01-10 15:02 d——– C:\WINDOWS\ERUNT
2008-01-10 12:24 . 2008-01-10 12:24 d—-c— C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\InstallShield
2008-01-10 12:23 . 2008-01-10 12:23 d—-c— C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\ATI
2008-01-03 11:46 . 2008-01-03 11:46 d—-c— C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
2007-12-24 19:13 . 2008-01-02 20:33 d——– C:\Program Files\Guild Wars
2007-12-24 14:59 . 2007-12-24 14:59 d—-c— C:\3d3e9a388af8f1745b76529800ee
2007-12-21 17:34 . 2006-01-26 13:21 34,686 –a—— C:\WINDOWS\system32\drivers\Capt905c.sys
2007-12-21 17:34 . 2006-01-26 13:21 24,569 –a—— C:\WINDOWS\system32\drivers\Camd905c.sys
2007-12-20 20:49 . 2007-12-20 20:49 d——– C:\Program Files\Virtools
2007-12-19 11:54 . 2007-12-19 19:21 25,088 –a—— C:\WINDOWS\system32\winsckdo.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-02 23:08 ——— d—–w C:\Program Files\Motorola Phone Tools
2008-01-02 23:05 ——— dc—-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\Road Runner
2008-01-02 23:05 ——— dc—-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\Leadertech
2008-01-02 23:05 ——— dc—-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\InterVideo
2008-01-02 23:05 ——— dc—-w C:\Documents and Settings\Kat\Application Data\Leadertech
2008-01-02 23:05 ——— dc—-w C:\Documents and Settings\All Users\Application Data\Road Runner
2008-01-02 23:05 ——— dc—-w C:\Documents and Settings\All Users\Application Data\CA
2008-01-02 23:05 ——— d—–w C:\Program Files\Yahoo!
2008-01-02 22:58 ——— d—–w C:\Program Files\Windows Installer Clean Up
2008-01-02 22:54 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-02 22:54 ——— d—–w C:\Program Files\Support.com
2008-01-02 22:54 ——— d—–w C:\Program Files\QuickTime
2008-01-02 22:54 ——— d—–w C:\Program Files\MSN Messenger
2008-01-02 22:54 ——— d—–w C:\Program Files\HP Instant Support
2008-01-02 22:53 ——— dc—-w C:\Documents and Settings\All Users\Application Data\yahoo!
2008-01-02 22:53 ——— dc—-w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-02 22:53 ——— dc—-w C:\Documents and Settings\All Users\Application Data\BVRP Software
2007-12-24 20:07 ——— d—–w C:\Program Files\Avanquest update
2007-12-07 20:44 24,192 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\usbsermptxp.sys
2007-12-07 20:44 22,768 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\usbsermpt.sys
2007-12-07 20:44 22,768 —-a-w C:\WINDOWS\system32\drivers\usbsermpt.sys
2007-12-03 20:56 69,632 —-a-w C:\WINDOWS\system32\realbap1.dll
2007-12-03 20:56 45,568 —-a-w C:\WINDOWS\system32\realbsf1.dll
2007-12-03 14:35 ——— d—–w C:\Program Files\Motorola
2007-12-01 19:05 3,567 —-a-w C:\WINDOWS\system32\drivers\PortTalk.sys
2007-12-01 18:03 ——— d—–w C:\Program Files\Common Files\Motorola Shared
2007-11-15 18:55 ——— d—–w C:\Program Files\Java
2007-11-14 22:08 92,064 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmmdm.sys
2007-11-14 22:08 9,232 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmmdfl.sys
2007-11-14 22:08 79,328 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmserd.sys
2007-11-14 22:08 66,656 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmbus.sys
2007-11-14 22:08 6,208 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmcmnt.sys
2007-11-14 22:08 5,936 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmwhnt.sys
2007-11-14 22:08 4,048 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmcr.sys
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-11 21:53 ——— dc—-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\VCOM
2007-11-11 21:53 ——— dc—-w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-11 21:53 ——— dc—-w C:\Documents and Settings\Administrator\Application Data\VCOM
2007-11-07 09:26 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 22:40 222,720 —-a-w C:\WINDOWS\system32\wmasf.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20 866584]
"Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-10-29 10:17 135168]
"snpstd"="C:\WINDOWS\vsnpstd.exe" [2003-12-31 16:39 40960]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2003-11-03 19:50 221184]
"QOELOADER"="C:\Program Files\CA\eTrust EZ Armor\eTrust Anti-Spam\QSP-2.1.215.5\QOELoader.exe" [2007-01-11 22:03 6656]
"OneCareUI"="C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" [ ]
"NWEReboot"="" []
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 19:04 52736]
"CAVRID"="C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe" [2007-02-11 22:52 185456]
"CaAvTray"="C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe" [2007-02-11 22:52 230512]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-11-13 21:10 335872]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 09:06 88363 C:\WINDOWS\AGRSMMSG.exe]
"medicsp2"="C:\Program Files\twc\medicsp2\bin\sprtcmd.exe" [2007-03-07 10:53 198184]
"VirusScannerPro"="C:\PROGRA~1\VCOM\Fix-It\MemCheck.exe" [2007-01-29 15:02 62976]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-03-05 10:10 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [ ]
R2 Fix-It Task Manager;Fix-It Task Manager;C:\PROGRA~1\VCOM\Fix-It\mxtask.exe [2007-01-29 15:02]
R2 sprtsvc_medicsp2;SupportSoft Sprocket Service (medicsp2);C:\Program Files\twc\medicsp2\bin\sprtsvc.exe /service []
R3 mxDisk;mxDisk;C:\PROGRA~1\VCOM\Fix-It\mxDisk.sys [2007-01-29 12:01]
S2 UMAXPCLS;Print Port Scanner Driver;C:\WINDOWS\system32\DRIVERS\umaxpcls.sys [2001-08-17 13:58]
S3 CCCP106;CIF USB Camera (2110A);C:\WINDOWS\system32\DRIVERS\cccp106.sys [2003-04-09 10:17]
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
"2007-04-15 14:11:23 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job"
- C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1
"2008-01-10 20:12:35 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-10 15:41:32
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-10 15:43:06
ComboFix-quarantined-files.txt 2008-01-10 20:42:45
.
2008-01-09 08:02:47 — E O F —