ComboFix 08-02-17.2 - stacey 2008-02-18 3:40:11.2 -
FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.225 [GMT 0:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\stacey\Desktop\cfscript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\Documents and Settings\All Users\Application Data\mmrpplic.dat
C:\FOUND.000
C:\PA207.DAT
C:\sqmdata02.sqm
C:\sqmdata03.sqm
C:\sqmdata04.sqm
C:\sqmdata05.sqm
C:\sqmdata06.sqm
C:\sqmdata07.sqm
C:\sqmdata08.sqm
C:\sqmdata09.sqm
C:\sqmdata10.sqm
C:\sqmnoopt17.sqm
C:\sqmnoopt18.sqm
C:\sqmnoopt19.sqm
C:\WINDOWS\
048298C9A4D3490B9FF9AB023A9238F3.TMP
C:\WINDOWS\SDA5D3FA8.tmp
C:\WINDOWS\system\SysSD.dll
C:\WINDOWS\system32\ccjbqydy.ini
C:\WINDOWS\system32\cvfdsbap.ini
C:\WINDOWS\system32\dihoqdtl.ini
C:\WINDOWS\system32\gostmmvu.ini
C:\WINDOWS\system32\SDRemoveDB.db
C:\WINDOWS\system32\sehsttdg.ini
C:\WINDOWS\system32\wvcsvc.exe
C:\WINDOWS\system32\xpmiwtob.ini
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data\mmrpplic.dat
C:\PA207.DAT
C:\Program Files\Macrogaming
C:\Program Files\Macrogaming\SweetIM\conf\adapter.xml
C:\Program Files\Macrogaming\SweetIM\conf\autoupdate.xml
C:\Program Files\Macrogaming\SweetIM\conf\logger.xml
C:\Program Files\Macrogaming\SweetIM\conf\messages.xml
C:\Program Files\Macrogaming\SweetIM\conf\sweetim.xml
C:\Program Files\Macrogaming\SweetIM\conf\sweetimapp.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\[removed]\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\[removed]\lastuse_SpecialFX.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\[removed]\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\main_user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\[removed]\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\[removed]\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\[removed]\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\[removed]\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\[removed]\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\[removed]\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\[removed]\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\[removed]\user_config.xml
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
000100D9.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00010106.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00010857.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00010859.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
0001085D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00010867.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
0001088F.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00010893.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
000108A8.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
000108A9.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
000108BB.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
000108BF.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
0002005D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
0002006A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00020071.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00020072.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00020075.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00020077.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
0002008A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
0002013F.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00020163.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00020175.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00020180.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00020186.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
0002018F.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
0003003E.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00030040.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
0003004D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00030056.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
0003005C.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
0003005D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
0003005E.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
0003005F.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00030061.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00030062.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00030063.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
0004001F.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00040022.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
0004002B.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
0004003C.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
0004005A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00040063.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
000400A3.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
000400C4.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00050004.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00050005.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
00050007.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
01050001.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\
01050002.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\cache_indx.dat
C:\Program Files\Macrogaming\SweetIM\default.xml
C:\Program Files\Macrogaming\SweetIM\mgAdaptersProxy.dll
C:\Program Files\Macrogaming\SweetIM\mgAIMAuto.dll
C:\Program Files\Macrogaming\SweetIM\mgAIMMessengerAdapter.dll
C:\Program Files\Macrogaming\SweetIM\mgArchive.dll
C:\Program Files\Macrogaming\SweetIM\mgcommon.dll
C:\Program Files\Macrogaming\SweetIM\mgcommunication.dll
C:\Program Files\Macrogaming\SweetIM\mgconfig.dll
C:\Program Files\Macrogaming\SweetIM\mgFlashPlayer.dll
C:\Program Files\Macrogaming\SweetIM\mghooking.dll
C:\Program Files\Macrogaming\SweetIM\mgIEPlayer.dll
C:\Program Files\Macrogaming\SweetIM\mglogger.dll
C:\Program Files\Macrogaming\SweetIM\mgMediaPlayer.dll
C:\Program Files\Macrogaming\SweetIM\mgMsnAuto.dll
C:\Program Files\Macrogaming\SweetIM\mgMsnMessengerAdapter.dll
C:\Program Files\Macrogaming\SweetIM\mgSweetIM.dll
C:\Program Files\Macrogaming\SweetIM\mgUpdateSupport.dll
C:\Program Files\Macrogaming\SweetIM\mgxml_wrapper.dll
C:\Program Files\Macrogaming\SweetIM\mgYahooAuto.dll
C:\Program Files\Macrogaming\SweetIM\mgYahooMessengerAdapter.dll
C:\Program Files\Macrogaming\SweetIM\msvcp71.dll
C:\Program Files\Macrogaming\SweetIM\msvcr71.dll
C:\Program Files\Macrogaming\SweetIM\resources\images\AudibleButton.png
C:\Program Files\Macrogaming\SweetIM\resources\images\DisplayPicturesButton.png
C:\Program Files\Macrogaming\SweetIM\resources\images\EmoticonButton.png
C:\Program Files\Macrogaming\SweetIM\resources\images\NudgeButton.png
C:\Program Files\Macrogaming\SweetIM\resources\images\SoundFxButton.png
C:\Program Files\Macrogaming\SweetIM\resources\images\WinksButton.png
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Macrogaming\SweetIMBarForIE\affid.dat
C:\Program Files\Macrogaming\SweetIMBarForIE\basis.xml
C:\Program Files\Macrogaming\SweetIMBarForIE\Bookmarks_23x18.bmp
C:\Program Files\Macrogaming\SweetIMBarForIE\Cache\cd2005c66fba47ff715ecc444d3bc1fb.xml
C:\Program Files\Macrogaming\SweetIMBarForIE\Email_23x18.bmp
C:\Program Files\Macrogaming\SweetIMBarForIE\Games_23x18.bmp
C:\Program Files\Macrogaming\SweetIMBarForIE\Greetingcards_23x18.bmp
C:\Program Files\Macrogaming\SweetIMBarForIE\Mobile_23x18.bmp
C:\Program Files\Macrogaming\SweetIMBarForIE\Music_23x18.bmp
C:\Program Files\Macrogaming\SweetIMBarForIE\News_23x18.bmp
C:\Program Files\Macrogaming\SweetIMBarForIE\Shoping_23x18.bmp
C:\Program Files\Macrogaming\SweetIMBarForIE\SmileySmile.bmp
C:\Program Files\Macrogaming\SweetIMBarForIE\SmileyWink.bmp
C:\Program Files\Macrogaming\SweetIMBarForIE\sweetimicons.bmp
C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.crc
C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.xml
C:\Program Files\Macrogaming\SweetIMBarForIE\version.txt
C:\Program Files\Sotfone
C:\Program Files\Sotfone\1202931840.dll
C:\sqmdata02.sqm
C:\sqmdata03.sqm
C:\sqmdata04.sqm
C:\sqmdata05.sqm
C:\sqmdata06.sqm
C:\sqmdata07.sqm
C:\sqmdata08.sqm
C:\sqmdata09.sqm
C:\sqmdata10.sqm
C:\sqmnoopt17.sqm
C:\sqmnoopt18.sqm
C:\sqmnoopt19.sqm
C:\WINDOWS\SDA5D3FA8.tmp . . . . failed to delete
C:\WINDOWS\system\SysSD.dll
C:\WINDOWS\system32\ccjbqydy.ini
C:\WINDOWS\system32\cvfdsbap.ini
C:\WINDOWS\system32\dihoqdtl.ini
C:\WINDOWS\system32\gostmmvu.ini
C:\WINDOWS\system32\SDRemoveDB.db
C:\WINDOWS\system32\sehsttdg.ini
C:\WINDOWS\system32\wvcsvc.exe
C:\WINDOWS\system32\xpmiwtob.ini
C:\WINDOWS\SDA5D3FA8.tmp . . . . failed to delete
.
((((((((((((((((((((((((( Files Created from 2008-01-18 to 2008-02-18 )))))))))))))))))))))))))))))))
.
2008-02-18 03:50 . 2008-02-18 03:50 0 ——— C:\WINDOWS\SDA5D3FA8.tmp
2008-02-17 20:51 . 2008-02-17 20:51 d——– C:\WINDOWS\system32\Kaspersky Lab
2008-02-17 20:51 . 2008-02-17 20:51 d——– C:\WINDOWS\LastGood.Tmp
2008-02-17 20:51 . 2008-02-17 20:51 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-16 13:03 . 2008-02-16 13:03 d——– C:\Program Files\Trend Micro
2008-02-14 21:56 . 2008-02-14 21:56 d——– C:\Program Files\AdwareAlert
2008-02-14 05:08 . 2008-02-14 05:08 d——– C:\VundoFix Backups
2008-02-12 20:00 . 2008-02-12 20:00 d——– C:\Program Files\Ace Utilities
2008-02-12 13:48 . 2008-02-12 13:48 d——– C:\WINDOWS\
048298C9A4D3490B9FF9AB023A9238F3.TMP
2008-02-12 13:44 . 2008-02-12 13:44 d——– C:\Documents and Settings\stacey\Application Data\AdwareAlert
2008-02-11 17:31 . 2008-02-11 17:31 d——– C:\Documents and Settings\adam\Application Data\AdwareAlert
2008-02-11 16:37 . 2008-02-11 16:37 d——– C:\Program Files\Enigma Software Group
2008-02-08 10:15 . 2008-02-08 10:15 d——– C:\Program Files\Spyware Doctor
2008-02-08 10:15 . 2008-02-08 10:15 d——– C:\Documents and Settings\stacey\Application Data\PC Tools
2008-02-08 10:15 . 2007-12-10 14:53 81,288 –a—— C:\WINDOWS\system32\drivers\iksyssec.sys
2008-02-08 10:15 . 2007-12-10 14:53 66,952 –a—— C:\WINDOWS\system32\drivers\iksysflt.sys
2008-02-08 10:15 . 2007-12-10 14:53 41,864 –a—— C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-02-08 10:15 . 2007-12-10 14:53 29,576 –a—— C:\WINDOWS\system32\drivers\kcom.sys
2008-02-08 09:22 . 2008-02-08 10:37 2,048 –a—— C:\WINDOWS\system32\drivers\kgpfr.cfg
2008-02-08 09:16 . 2008-02-08 09:17 d——– C:\Documents and Settings\All Users\Application Data\SITEguard
2008-02-08 09:15 . 2008-02-08 09:15 d——– C:\Program Files\Common Files\iS3
2008-02-08 09:15 . 2008-02-08 09:15 d——– C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-02-07 16:51 . 2008-02-07 16:51 d–hs—- C:\FOUND.000
2008-02-06 10:51 . 2008-02-06 10:51 d——– C:\Program Files\Spybot - Search & Destroy
2008-02-06 10:51 . 2008-02-06 10:51 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-06 10:08 . 2008-02-06 10:08 d——– C:\Program Files\Digital Locker Assistant
2008-02-04 19:53 . 2008-02-04 19:53 d——– C:\Documents and Settings\sarah\Application Data\skypePM
2008-02-03 21:45 . 2008-02-03 21:46 d——– C:\Documents and Settings\sarah\Application Data\Skype
2008-02-02 13:48 . 2008-02-02 13:48 d——– C:\Documents and Settings\adam\Application Data\skypePM
2008-02-02 13:48 . 2008-02-02 13:48 32 –a—— C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-02-02 13:45 . 2008-02-02 13:45 d——– C:\Program Files\Skype
2008-02-02 13:45 . 2008-02-02 13:45 d——– C:\Program Files\Common Files\Skype
2008-01-24 20:22 . 2008-01-24 20:22 d——– C:\Program Files\Driving Test Success 2007-2008
2008-01-24 20:22 . 2008-01-24 20:22 d——– C:\Documents and Settings\All Users\Application Data\Driving Test Success
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-16 13:13 2,286 —-a-w C:\Documents and Settings\adam\Application Data\wklnhst.dat
2008-02-13 11:09 712 —-a-w C:\Documents and Settings\stacey\Application Data\wklnhst.dat
2008-01-15 09:54 10,537 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.cat
2008-01-15 05:28 706 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-01-13 13:42 ——— d—–w C:\Documents and Settings\stacey\Application Data\Nero
2008-01-13 13:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\Ahead
2008-01-13 12:03 ——— d—–w C:\Documents and Settings\stacey\Application Data\Ahead
2008-01-13 12:02 ——— d—–w C:\Program Files\Nero
2008-01-13 12:02 ——— d—–w C:\Program Files\Common Files\Ahead
2008-01-12 18:45 ——— d—–w C:\Program Files\Quick AVI Splitter
2008-01-12 18:32 23,904 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-01-11 05:53 44,544 —-a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2008-01-05 09:38 ——— d—–w C:\Program Files\Common Files\Blizzard Entertainment
2008-01-03 13:28 ——— d—–w C:\Program Files\MoparScape
2008-01-02 18:45 ——— d—–w C:\Program Files\Sun
2008-01-02 18:29 ——— d—–w C:\Documents and Settings\adam\Application Data\Hamachi
2008-01-02 18:27 25,280 —-a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-01-02 18:27 ——— d—–w C:\Program Files\Hamachi
2007-12-25 10:57 ——— d—–w C:\Documents and Settings\adam\Application Data\ArcSoft
2007-12-25 10:42 ——— d—–w C:\Program Files\Common Files\PAC207
2007-12-25 10:40 ——— d—–w C:\Program Files\Common Files\ArcSoft
2007-12-25 10:39 ——— d—–w C:\Program Files\ArcSoft
2007-12-25 10:38 ——— d—–w C:\Program Files\Trust
2007-12-23 12:00 ——— d—–w C:\Program Files\CamStudio
2007-12-19 23:01 347,136 —-a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-12-19 14:40 ——— d—–w C:\Program Files\Common Files\Sony Shared
2007-12-18 09:51 179,584 —-a-w C:\WINDOWS\system32\drivers\mrxdav.sys
2007-12-18 09:51 179,584 ——w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-08 05:21 3,592,192 —-a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-12-06 11:01 625,664 ——w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-12-06 11:00 70,656 ——w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-12-06 11:00 13,824 ——w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-12-06 04:59 161,792 —-a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-12-05 09:24 60,800 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
2007-12-04 18:38 550,912 —-a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 18:38 550,912 ——w C:\WINDOWS\system32\dllcache\oleaut32.dll
2007-10-16 23:20 3,406 —-a-w C:\Documents and Settings\sarah\Application Data\wklnhst.dat
2007-03-10 12:55 392 —-a-w C:\Documents and Settings\rebecca\Application Data\wklnhst.dat
2006-12-17 16:35 326 —ha-w C:\Documents and Settings\All Users\hpothb07.dat
2006-12-17 16:35 200 —ha-w C:\Documents and Settings\adam\hpothb07.dat
2006-12-17 16:35 200 —ha-w C:\Documents and Settings\ADAM 2\hpothb07.dat
2006-12-17 16:35 0 —ha-w C:\Documents and Settings\Default User\hpothb07.dat
2006-08-20 17:41 32 —-a-r C:\Documents and Settings\All Users\hash.dat
2005-04-20 17:01 161 —ha-w C:\Documents and Settings\stacey\hpothb07.dat
2007-11-02 17:36 848 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"kdx"="C:\WINDOWS\kdx\KHost.exe" [2007-05-11 09:46 2236416]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:56 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]
"nwiz"="nwiz.exe" [2003-11-26 07:43 753664 C:\WINDOWS\system32\nwiz.exe]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-09-23 08:33 1838592]
"Monitor"="C:\WINDOWS\PixArt\PAC207\Monitor.exe" [2006-11-03 11:01 319488]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-09-03 08:04 84640]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2003-11-26 07:43 3022848]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 07:56 15360]
"ALUAlert"="C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [2006-09-03 00:36 100032]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 13:45 36040]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 07:56 53760 C:\WINDOWS\system32\narrator.exe]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
path=
backup=
[HKLM\~\startupfolder\C:^Documents and Settings^adam^Start Menu^Programs^Startup^Adobe Gamma.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^adam^Start Menu^Programs^Startup^hamachi.lnk]
backup=C:\WINDOWS\pss\hamachi.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
–a—— 2005-06-06 23:46 57344 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CARPService]
–a—— 2003-06-11 11:54 4608 C:\WINDOWS\system32\carpserv.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
–a—— 2006-09-03 08:04 84640 C:\Program Files\Common Files\Symantec Shared\ccApp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
–a—— 2005-01-19 11:05 221184 C:\WINDOWS\system32\LVCOMSX.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
–a—— 2003-04-14 19:30 1491216 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]
–a—— 2006-09-06 02:22 26248 C:\Program Files\Norton Internet Security\osCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Power2GoExpress]
——— 2004-05-17 11:36 839770 C:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
–a—— 2005-01-12 03:01 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
-ra—— 2005-10-26 16:17 159744 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
–a—— 2003-08-04 23:59 57344 C:\WINDOWS\SOUNDMAN.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics]
–a—— 2004-01-26 11:38 866816 C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SupaDial]
–a—— 2003-08-26 16:40 286720 C:\Program Files\SupaDial\SupaDial.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
–a—— 2007-03-14 16:52 3770024 C:\Program Files\TomTom HOME\TomTomHOME.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
–a—— 2006-11-03 18:20 866584 C:\Program Files\Windows Defender\MSASCui.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Power2GoExpress"=C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"mmtask"=c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
R1 kbfilter;Keyboard Filter Driver;C:\WINDOWS\system32\drivers\kbfilter.sys [2002-10-15 14:48]
R2 BT848;AVerMedia, AVerTV WDM Video Capture;C:\WINDOWS\system32\drivers\BT848.sys [2002-05-13 19:40]
R2 BTTUNER;AVerMedia, AVerTV WDM TvTuner;C:\WINDOWS\system32\drivers\BTTUNER.sys [2002-01-27 04:57]
R2 BTXBAR;AVerMedia, AVerTV WDM Crossbar;C:\WINDOWS\system32\drivers\BTXBAR.sys [2002-01-27 05:02]
R3 PAC207;Trust WB-1400T Webcam;C:\WINDOWS\system32\DRIVERS\PFC027.SYS [2007-05-14 10:26]
S2 Ca536av;DigitalCam Pro Video Camera Device;C:\WINDOWS\system32\Drivers\Ca536av.sys [2004-05-21 19:21]
S3 alcan5ln;SpeedTouch™ USB ADSL RFC1483 Networking Driver (NDIS);C:\WINDOWS\system32\DRIVERS\alcan5ln.sys [2003-12-08 11:53]
S3 USBCamera;DigitalCam Pro Still Camera Device;C:\WINDOWS\system32\Drivers\Bulk536.sys [2003-05-14 09:28]
*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-02-18 04:03:08 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-02-17 21:27:02 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1096057614.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
"2008-02-18 03:00:02 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job"
- C:\Program Files\AdwareAlert\AdwareAlert.ex
- C:\Program Files\AdwareAlert
"2008-02-15 20:00:02 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - stacey.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/TASK:
"2007-08-09 05:23:22 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
"2008-02-18 04:03:46 C:\WINDOWS\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-02-18 04:00:45
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\UAService7.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
.
**************************************************************************
.
Completion time: 2008-02-18 4:07:08 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-18 04:06:58
ComboFix4.txt 2008-02-17 12:10:52
ComboFix3.txt 2008-02-17 12:35:36
ComboFix2.txt 2008-02-17 20:46:16
.
2008-02-16 20:48:45 — E O F —