SVKUMAR
Topic Starter
Thanks a lot am computer hang with " Windows cannot find c:\program. Please make sure you typed the name correctly and then try again. To search for a file, click the Start button, and then click Search." but now its perfectly good
nice job
ComboFix 08-08-19.03 - kumaribs 2008-08-21 8:47:49.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.710 [GMT 4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-07-21 to 2008-08-21 )))))))))))))))))))))))))))))))
.
2008-08-20 18:02 . 2008-08-20 18:02 d——– C:\Documents and Settings\All Users\kumaribs
2008-08-20 17:42 . 2008-08-20 17:42 137 –a—— C:\WINDOWS\system32\MRT.INI
2008-08-20 17:39 . 2008-06-23 20:57 6,066,176 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll
2008-08-20 17:39 . 2007-04-17 13:32 2,455,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-08-20 17:39 . 2007-03-08 09:10 991,232 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-08-20 17:39 . 2008-06-23 20:57 459,264 —–c— C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-08-20 17:39 . 2008-06-23 20:57 383,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-08-20 17:39 . 2008-06-23 20:57 267,776 —–c— C:\WINDOWS\system32\dllcache\iertutil.dll
2008-08-20 17:39 . 2008-06-23 20:57 63,488 —–c— C:\WINDOWS\system32\dllcache\icardie.dll
2008-08-20 17:39 . 2008-06-23 20:57 52,224 —–c— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-08-20 17:39 . 2008-06-23 13:20 13,824 —–c— C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-08-20 16:25 . 2007-07-30 19:19 43,352 –a—— C:\WINDOWS\system32\wups2.dll
2008-08-20 16:25 . 2007-07-30 19:18 34,136 –a—— C:\WINDOWS\system32\wucltui.dll.mui
2008-08-20 16:25 . 2007-07-30 19:19 25,944 –a—— C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-08-20 16:25 . 2007-07-30 19:19 25,944 –a—— C:\WINDOWS\system32\wuapi.dll.mui
2008-08-20 16:25 . 2007-07-30 19:18 20,312 –a—— C:\WINDOWS\system32\wuaueng.dll.mui
2008-08-20 13:05 . 2008-08-20 13:05 d——– C:\Documents and Settings\All Users\Application Data\Google Updater
2008-08-20 10:07 . 2008-08-20 10:07 d——– C:\Program Files\KGB Archiver
2008-08-19 15:19 . 2008-07-22 20:03 32,768 –a—— C:\Program Files\bcd_installed.exe
2008-08-18 14:38 . 2008-08-18 14:38 d——– C:\My Music
2008-08-18 14:38 . 2008-08-18 14:43 135 –a—— C:\WINDOWS\Mp3CutterJoiner.ini
2008-08-18 14:37 . 2008-08-18 14:37 d——– C:\Program Files\AudioToolsFactory
2008-08-18 14:37 . 2004-12-08 13:21 1,843,200 –a—— C:\WINDOWS\system32\NCTAudioFile2.dll
2008-08-18 14:37 . 2004-08-02 15:09 450,560 –a—— C:\WINDOWS\system32\NCTAudioTransform2.dll
2008-08-18 14:37 . 2002-01-05 14:37 344,064 –a—— C:\WINDOWS\system32\msvcr70.dll
2008-08-18 14:37 . 2004-12-01 14:43 315,392 –a—— C:\WINDOWS\system32\NCTAudioPlayer2.dll
2008-08-18 14:37 . 2003-08-07 14:01 237,568 –a—— C:\WINDOWS\system32\lame_enc.dll
2008-08-18 14:37 . 2004-05-20 14:24 196,608 –a—— C:\WINDOWS\system32\NCTWMAFile2.dll
2008-08-18 14:37 . 2003-12-08 12:49 116,304 –a—— C:\WINDOWS\system32\NCTWMAProfiles.prx
2008-08-18 14:37 . 2008-08-18 14:43 5 –a—— C:\WINDOWS\system32\SySMP3CutJoin.dat
2008-08-18 14:26 . 2008-08-18 14:34 d——– C:\Program Files\Everstrike Software
2008-08-18 14:26 . 2008-08-18 14:26 d——– C:\Program Files\Common Files\Everstrike Software
2008-08-18 13:25 . 2008-08-18 13:31 20 –a—— C:\sccfg.sys
2008-08-16 17:21 . 2008-08-19 10:32 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-16 14:55 . 2008-04-14 16:00 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2008-08-13 15:05 . 2008-08-13 16:10 d——– C:\Program Files\Daily Planner Plus 6.0
2008-08-13 15:05 . 1998-06-24 00:00 108,336 –a—— C:\WINDOWS\system32\mswinsck.ocx
2008-08-13 15:04 . 2008-08-14 08:03 d——– C:\WINDOWS\system32\drivers\setup
2008-08-13 13:33 . 2008-08-13 13:39 d——– C:\Documents and Settings\kumaribs\Shared
2008-08-13 13:32 . 2008-08-13 13:44 d——– C:\Documents and Settings\kumaribs\Incomplete
2008-08-13 13:32 . 2008-08-13 13:39 d——– C:\Documents and Settings\kumaribs\Application Data\LimeWire
2008-08-13 13:29 . 2008-08-13 13:29 d——– C:\Program Files\Java
2008-08-13 13:29 . 2008-08-13 13:29 d——– C:\Program Files\Common Files\Java
2008-08-13 13:29 . 2008-06-10 02:32 73,728 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-08-13 09:22 . 2008-08-13 09:22 d–h—– C:\WINDOWS\system32\GroupPolicy
2008-08-13 09:03 . 2008-08-20 17:43 d–h—– C:\WINDOWS\$hf_mig$
2008-08-11 14:03 . 2008-08-11 14:04 d——– C:\Program Files\History Sweeper
2008-08-11 11:30 . 2008-08-11 11:31 d——– C:\Program Files\Microsoft Reader
2008-08-11 11:30 . 2003-06-05 17:15 57,436 –a—— C:\WINDOWS\DASShp.dll
2008-08-11 09:47 . 2008-08-11 09:47 d——– C:\Documents and Settings\kumaribs\Application Data\Palo Alto Software
2008-08-11 09:44 . 2008-08-11 09:44 d——– C:\Program Files\Common Files\Intuit
2008-08-11 09:44 . 2008-08-11 09:44 d——– C:\Documents and Settings\All Users\Application Data\Palo Alto Software
2008-08-11 09:40 . 2008-08-11 09:40 d——– C:\Documents and Settings\All Users\Application Data\PAS
2008-08-11 09:21 . 2008-08-11 09:21 d——– C:\Program Files\PowerISO
2008-08-11 08:34 . 2008-08-11 08:37 d——– C:\Program Files\Flash Website Design
2008-08-09 10:12 . 2008-08-20 13:06 d——– C:\Program Files\Google
2008-08-07 17:59 . 2008-08-07 17:59 d——– C:\Program Files\MagicISO
2008-08-06 16:03 . 2008-08-06 16:03 0 –a—— C:\WINDOWS\nsreg.dat
2008-08-06 09:34 . 2007-11-28 11:08 2,720,449 –a—— C:\Program Files\Common Files\Magic ISO Maker 5.4 Build 239.exe
2008-08-05 15:03 . 2008-08-21 08:36 d——– C:\Documents and Settings\All Users\Application Data\Avira
2008-08-05 13:43 . 2008-08-05 13:43 d——– C:\Program Files\uTorrent
2008-08-05 13:43 . 2008-08-21 08:13 d——– C:\Documents and Settings\kumaribs\Application Data\uTorrent
2008-08-05 13:37 . 2008-08-05 13:37 d——– C:\Program Files\DNA
2008-08-05 13:37 . 2008-08-21 08:38 d——– C:\Documents and Settings\kumaribs\Application Data\DNA
2008-08-04 18:38 . 2008-08-04 18:38 d——– C:\Program Files\Atheros
2008-08-04 18:38 . 2007-04-05 07:19 546,112 –a—— C:\WINDOWS\system32\drivers\ar5211.sys
2008-08-04 18:37 . 2008-08-11 11:30 d——– C:\Program Files\Common Files\InstallShield
2008-08-04 18:37 . 2008-08-04 18:37 d——– C:\Documents and Settings\All Users\Application Data\Atheros
2008-08-04 18:29 . 2008-08-04 18:29 d——– C:\DRIVERS
2008-08-04 18:03 . 2008-08-04 18:03 23,600 –a—— C:\WINDOWS\system32\drivers\TVICHW32.SYS
2008-08-04 17:55 . 2008-08-04 17:55 d——– C:\WINDOWS\system32\LogFiles
2008-08-04 17:25 . 2008-08-04 17:53 512 –a—— C:\WINDOWS\randseed.rnd
2008-08-04 17:08 . 2008-08-04 17:08 d——– C:\Program Files\Common Files\Cisco Systems
2008-08-04 17:06 . 2008-08-04 17:06 d–hs—- C:\Documents and Settings\kumaribs\UserData
2008-08-04 16:58 . 2008-08-04 16:52 6,786,339 –a—— C:\FSC_IntelWirelessWiFiLink4965AGNPROWireless39_111086XP_1012092.zip
2008-08-04 16:38 . 2008-08-04 16:38 d——– C:\Program Files\Microsoft.NET
2008-08-04 16:38 . 2008-08-04 16:38 d——– C:\Program Files\Microsoft ActiveSync
2008-08-04 16:38 . 2003-06-18 17:31 17,920 –a—— C:\WINDOWS\system32\mdimon.dll
2008-08-04 16:38 . 2008-08-04 16:38 376 –a—— C:\WINDOWS\ODBC.INI
2008-08-04 16:37 . 2008-08-04 16:38 d——– C:\WINDOWS\SHELLNEW
2008-08-04 16:34 . 2008-08-04 16:34 dr-h—– C:\MSOCache
2008-08-04 16:29 . 2008-08-04 16:29 d——– C:\Program Files\Common Files\Adobe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-13 11:06 2,789 —-a-w C:\Program Files\Daily Planner Plus 6.0.lnk
2008-08-11 07:30 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-08-09 12:04 ——— d—–w C:\Program Files\Launch Manager
2008-08-04 11:42 0 —ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01000_Coinstaller_Critical.Wdf
2008-08-04 11:42 0 —ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_SynTP_01000.Wdf
2008-08-04 11:42 ——— d—–w C:\Program Files\Synaptics
2008-08-04 11:42 ——— d—–w C:\Program Files\Realtek
2008-08-04 11:42 ——— d—–w C:\Documents and Settings\kumaribs\Application Data\InstallShield
2008-08-04 11:41 ——— d—–w C:\Program Files\CONEXANT
2008-08-04 11:39 ——— d—–w C:\Program Files\Intel
2008-08-04 11:30 ——— d—–w C:\Program Files\microsoft frontpage
2008-07-07 20:26 253,952 —-a-w C:\WINDOWS\system32\es.dll
2008-07-07 07:40 56,108 —-a-w C:\WINDOWS\system32\drivers\scdemu.sys
2008-06-24 16:43 74,240 —-a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 —-a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:46 245,248 —-a-w C:\WINDOWS\system32\mswsock.dll
.
((((((((((((((((((((((((((((( snapshot@2008-08-20_18.32.39.62 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-20 14:05:09 41,706 —-a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-08-21 04:43:50 41,706 —-a-w C:\WINDOWS\system32\perfc009.dat
- 2008-08-20 14:05:09 316,088 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-08-21 04:43:50 316,088 —-a-w C:\WINDOWS\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-08-05 13:37 341824]
"Sweeper.exe"="C:\Program Files\History Sweeper\sweeper.exe" [2007-12-13 08:19 176128]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 16:00 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-04-20 13:57 142104]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-04-20 13:57 162584]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-04-20 13:57 138008]
"HotkeyApp"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2007-04-26 10:30 192512]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 11:00 815104]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [BU]
"LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [BU]
"Wbutton"="C:\Program Files\Launch Manager\WButton.exe" [BU]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 16:00 110592 C:\WINDOWS\system32\bthprops.cpl]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2008-04-14 05:42 1695232 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
–a—— 2008-07-07 11:34 167936 C:\Program Files\PowerISO\PWRISOVM.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"mW[íµˆÖ¾`=µú¾˜v%S8’ÿÙêé>grl>Ý\†Ð=Ÿà Û±Þ"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\program files\\bcd_installed.exe"=
R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys [2003-04-28 11:27]
R3 WisLMSvc;WisLMSvc;C:\Program Files\Launch Manager\WisLMSvc.exe [2006-11-17 20:45]
*Newly Created Service* - CATCHME
.
.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\kumaribs\Application Data\Mozilla\Firefox\Profiles\8j1o1yln.default\
FF -: plugin - C:\Program Files\DNA\plugins\npbtdna.dll
FF -: plugin - C:\Program Files\Google\Google Updater\2.3.1314.1135\npCIDetect12.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-21 08:48:50
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CtrlVol = C:\Program Files\Launch Manager\CtrlVol.exe?x???0???????????0???A??|???????|???|???????|????????L???????PJ????F?????????????h?????????????B????????|@??|????=??|J?A?????????i?A?k?"U??B~??????F??b@?????????????? A??grU????i?A?{?@?@J??6m@?@J????"U??@?PJ?????
LaunchAp = C:\Program Files\Launch Manager\LaunchAp.exe????0???????????0???A??|???????|???|???????|????????L???????PJ????F?????????????h?????????????B????????|@??|????=??|J?A?????????i?A?k?"U??B~??????F??b@?????????????? A??grU????i?A?{?@?@J??6m@?@J????"U??@?PJ?????
Wbutton = C:\Program Files\Launch Manager\WButton.exe?????0???????????0???A??|???????|???|???????|????????L???????PJ????F?????????????h?????????????B????????|@??|????=??|J?A?????????i?A?k?"U??B~??????F??b@?????????????? A??grU????i?A?{?@?@J??6m@?@J????"U??@?PJ?????
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-08-21 8:49:15
ComboFix-quarantined-files.txt 2008-08-21 04:49:11
ComboFix2.txt 2008-08-20 14:32:57
Pre-Run: 25,889,189,888 bytes free
Post-Run: 25,878,478,848 bytes free
191
nice job
ComboFix 08-08-19.03 - kumaribs 2008-08-21 8:47:49.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.710 [GMT 4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-07-21 to 2008-08-21 )))))))))))))))))))))))))))))))
.
2008-08-20 18:02 . 2008-08-20 18:02 d——– C:\Documents and Settings\All Users\kumaribs
2008-08-20 17:42 . 2008-08-20 17:42 137 –a—— C:\WINDOWS\system32\MRT.INI
2008-08-20 17:39 . 2008-06-23 20:57 6,066,176 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll
2008-08-20 17:39 . 2007-04-17 13:32 2,455,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-08-20 17:39 . 2007-03-08 09:10 991,232 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-08-20 17:39 . 2008-06-23 20:57 459,264 —–c— C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-08-20 17:39 . 2008-06-23 20:57 383,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-08-20 17:39 . 2008-06-23 20:57 267,776 —–c— C:\WINDOWS\system32\dllcache\iertutil.dll
2008-08-20 17:39 . 2008-06-23 20:57 63,488 —–c— C:\WINDOWS\system32\dllcache\icardie.dll
2008-08-20 17:39 . 2008-06-23 20:57 52,224 —–c— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-08-20 17:39 . 2008-06-23 13:20 13,824 —–c— C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-08-20 16:25 . 2007-07-30 19:19 43,352 –a—— C:\WINDOWS\system32\wups2.dll
2008-08-20 16:25 . 2007-07-30 19:18 34,136 –a—— C:\WINDOWS\system32\wucltui.dll.mui
2008-08-20 16:25 . 2007-07-30 19:19 25,944 –a—— C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-08-20 16:25 . 2007-07-30 19:19 25,944 –a—— C:\WINDOWS\system32\wuapi.dll.mui
2008-08-20 16:25 . 2007-07-30 19:18 20,312 –a—— C:\WINDOWS\system32\wuaueng.dll.mui
2008-08-20 13:05 . 2008-08-20 13:05 d——– C:\Documents and Settings\All Users\Application Data\Google Updater
2008-08-20 10:07 . 2008-08-20 10:07 d——– C:\Program Files\KGB Archiver
2008-08-19 15:19 . 2008-07-22 20:03 32,768 –a—— C:\Program Files\bcd_installed.exe
2008-08-18 14:38 . 2008-08-18 14:38 d——– C:\My Music
2008-08-18 14:38 . 2008-08-18 14:43 135 –a—— C:\WINDOWS\Mp3CutterJoiner.ini
2008-08-18 14:37 . 2008-08-18 14:37 d——– C:\Program Files\AudioToolsFactory
2008-08-18 14:37 . 2004-12-08 13:21 1,843,200 –a—— C:\WINDOWS\system32\NCTAudioFile2.dll
2008-08-18 14:37 . 2004-08-02 15:09 450,560 –a—— C:\WINDOWS\system32\NCTAudioTransform2.dll
2008-08-18 14:37 . 2002-01-05 14:37 344,064 –a—— C:\WINDOWS\system32\msvcr70.dll
2008-08-18 14:37 . 2004-12-01 14:43 315,392 –a—— C:\WINDOWS\system32\NCTAudioPlayer2.dll
2008-08-18 14:37 . 2003-08-07 14:01 237,568 –a—— C:\WINDOWS\system32\lame_enc.dll
2008-08-18 14:37 . 2004-05-20 14:24 196,608 –a—— C:\WINDOWS\system32\NCTWMAFile2.dll
2008-08-18 14:37 . 2003-12-08 12:49 116,304 –a—— C:\WINDOWS\system32\NCTWMAProfiles.prx
2008-08-18 14:37 . 2008-08-18 14:43 5 –a—— C:\WINDOWS\system32\SySMP3CutJoin.dat
2008-08-18 14:26 . 2008-08-18 14:34 d——– C:\Program Files\Everstrike Software
2008-08-18 14:26 . 2008-08-18 14:26 d——– C:\Program Files\Common Files\Everstrike Software
2008-08-18 13:25 . 2008-08-18 13:31 20 –a—— C:\sccfg.sys
2008-08-16 17:21 . 2008-08-19 10:32 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-16 14:55 . 2008-04-14 16:00 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2008-08-13 15:05 . 2008-08-13 16:10 d——– C:\Program Files\Daily Planner Plus 6.0
2008-08-13 15:05 . 1998-06-24 00:00 108,336 –a—— C:\WINDOWS\system32\mswinsck.ocx
2008-08-13 15:04 . 2008-08-14 08:03 d——– C:\WINDOWS\system32\drivers\setup
2008-08-13 13:33 . 2008-08-13 13:39 d——– C:\Documents and Settings\kumaribs\Shared
2008-08-13 13:32 . 2008-08-13 13:44 d——– C:\Documents and Settings\kumaribs\Incomplete
2008-08-13 13:32 . 2008-08-13 13:39 d——– C:\Documents and Settings\kumaribs\Application Data\LimeWire
2008-08-13 13:29 . 2008-08-13 13:29 d——– C:\Program Files\Java
2008-08-13 13:29 . 2008-08-13 13:29 d——– C:\Program Files\Common Files\Java
2008-08-13 13:29 . 2008-06-10 02:32 73,728 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-08-13 09:22 . 2008-08-13 09:22 d–h—– C:\WINDOWS\system32\GroupPolicy
2008-08-13 09:03 . 2008-08-20 17:43 d–h—– C:\WINDOWS\$hf_mig$
2008-08-11 14:03 . 2008-08-11 14:04 d——– C:\Program Files\History Sweeper
2008-08-11 11:30 . 2008-08-11 11:31 d——– C:\Program Files\Microsoft Reader
2008-08-11 11:30 . 2003-06-05 17:15 57,436 –a—— C:\WINDOWS\DASShp.dll
2008-08-11 09:47 . 2008-08-11 09:47 d——– C:\Documents and Settings\kumaribs\Application Data\Palo Alto Software
2008-08-11 09:44 . 2008-08-11 09:44 d——– C:\Program Files\Common Files\Intuit
2008-08-11 09:44 . 2008-08-11 09:44 d——– C:\Documents and Settings\All Users\Application Data\Palo Alto Software
2008-08-11 09:40 . 2008-08-11 09:40 d——– C:\Documents and Settings\All Users\Application Data\PAS
2008-08-11 09:21 . 2008-08-11 09:21 d——– C:\Program Files\PowerISO
2008-08-11 08:34 . 2008-08-11 08:37 d——– C:\Program Files\Flash Website Design
2008-08-09 10:12 . 2008-08-20 13:06 d——– C:\Program Files\Google
2008-08-07 17:59 . 2008-08-07 17:59 d——– C:\Program Files\MagicISO
2008-08-06 16:03 . 2008-08-06 16:03 0 –a—— C:\WINDOWS\nsreg.dat
2008-08-06 09:34 . 2007-11-28 11:08 2,720,449 –a—— C:\Program Files\Common Files\Magic ISO Maker 5.4 Build 239.exe
2008-08-05 15:03 . 2008-08-21 08:36 d——– C:\Documents and Settings\All Users\Application Data\Avira
2008-08-05 13:43 . 2008-08-05 13:43 d——– C:\Program Files\uTorrent
2008-08-05 13:43 . 2008-08-21 08:13 d——– C:\Documents and Settings\kumaribs\Application Data\uTorrent
2008-08-05 13:37 . 2008-08-05 13:37 d——– C:\Program Files\DNA
2008-08-05 13:37 . 2008-08-21 08:38 d——– C:\Documents and Settings\kumaribs\Application Data\DNA
2008-08-04 18:38 . 2008-08-04 18:38 d——– C:\Program Files\Atheros
2008-08-04 18:38 . 2007-04-05 07:19 546,112 –a—— C:\WINDOWS\system32\drivers\ar5211.sys
2008-08-04 18:37 . 2008-08-11 11:30 d——– C:\Program Files\Common Files\InstallShield
2008-08-04 18:37 . 2008-08-04 18:37 d——– C:\Documents and Settings\All Users\Application Data\Atheros
2008-08-04 18:29 . 2008-08-04 18:29 d——– C:\DRIVERS
2008-08-04 18:03 . 2008-08-04 18:03 23,600 –a—— C:\WINDOWS\system32\drivers\TVICHW32.SYS
2008-08-04 17:55 . 2008-08-04 17:55 d——– C:\WINDOWS\system32\LogFiles
2008-08-04 17:25 . 2008-08-04 17:53 512 –a—— C:\WINDOWS\randseed.rnd
2008-08-04 17:08 . 2008-08-04 17:08 d——– C:\Program Files\Common Files\Cisco Systems
2008-08-04 17:06 . 2008-08-04 17:06 d–hs—- C:\Documents and Settings\kumaribs\UserData
2008-08-04 16:58 . 2008-08-04 16:52 6,786,339 –a—— C:\FSC_IntelWirelessWiFiLink4965AGNPROWireless39_111086XP_1012092.zip
2008-08-04 16:38 . 2008-08-04 16:38 d——– C:\Program Files\Microsoft.NET
2008-08-04 16:38 . 2008-08-04 16:38 d——– C:\Program Files\Microsoft ActiveSync
2008-08-04 16:38 . 2003-06-18 17:31 17,920 –a—— C:\WINDOWS\system32\mdimon.dll
2008-08-04 16:38 . 2008-08-04 16:38 376 –a—— C:\WINDOWS\ODBC.INI
2008-08-04 16:37 . 2008-08-04 16:38 d——– C:\WINDOWS\SHELLNEW
2008-08-04 16:34 . 2008-08-04 16:34 dr-h—– C:\MSOCache
2008-08-04 16:29 . 2008-08-04 16:29 d——– C:\Program Files\Common Files\Adobe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-13 11:06 2,789 —-a-w C:\Program Files\Daily Planner Plus 6.0.lnk
2008-08-11 07:30 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-08-09 12:04 ——— d—–w C:\Program Files\Launch Manager
2008-08-04 11:42 0 —ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01000_Coinstaller_Critical.Wdf
2008-08-04 11:42 0 —ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_SynTP_01000.Wdf
2008-08-04 11:42 ——— d—–w C:\Program Files\Synaptics
2008-08-04 11:42 ——— d—–w C:\Program Files\Realtek
2008-08-04 11:42 ——— d—–w C:\Documents and Settings\kumaribs\Application Data\InstallShield
2008-08-04 11:41 ——— d—–w C:\Program Files\CONEXANT
2008-08-04 11:39 ——— d—–w C:\Program Files\Intel
2008-08-04 11:30 ——— d—–w C:\Program Files\microsoft frontpage
2008-07-07 20:26 253,952 —-a-w C:\WINDOWS\system32\es.dll
2008-07-07 07:40 56,108 —-a-w C:\WINDOWS\system32\drivers\scdemu.sys
2008-06-24 16:43 74,240 —-a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 —-a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:46 245,248 —-a-w C:\WINDOWS\system32\mswsock.dll
.
((((((((((((((((((((((((((((( snapshot@2008-08-20_18.32.39.62 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-20 14:05:09 41,706 —-a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-08-21 04:43:50 41,706 —-a-w C:\WINDOWS\system32\perfc009.dat
- 2008-08-20 14:05:09 316,088 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-08-21 04:43:50 316,088 —-a-w C:\WINDOWS\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-08-05 13:37 341824]
"Sweeper.exe"="C:\Program Files\History Sweeper\sweeper.exe" [2007-12-13 08:19 176128]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 16:00 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-04-20 13:57 142104]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-04-20 13:57 162584]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-04-20 13:57 138008]
"HotkeyApp"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2007-04-26 10:30 192512]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 11:00 815104]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [BU]
"LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [BU]
"Wbutton"="C:\Program Files\Launch Manager\WButton.exe" [BU]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 16:00 110592 C:\WINDOWS\system32\bthprops.cpl]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2008-04-14 05:42 1695232 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
–a—— 2008-07-07 11:34 167936 C:\Program Files\PowerISO\PWRISOVM.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"mW[íµˆÖ¾`=µú¾˜v%S8’ÿÙêé>grl>Ý\†Ð=Ÿà Û±Þ"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\program files\\bcd_installed.exe"=
R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys [2003-04-28 11:27]
R3 WisLMSvc;WisLMSvc;C:\Program Files\Launch Manager\WisLMSvc.exe [2006-11-17 20:45]
*Newly Created Service* - CATCHME
.
.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\kumaribs\Application Data\Mozilla\Firefox\Profiles\8j1o1yln.default\
FF -: plugin - C:\Program Files\DNA\plugins\npbtdna.dll
FF -: plugin - C:\Program Files\Google\Google Updater\2.3.1314.1135\npCIDetect12.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-21 08:48:50
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CtrlVol = C:\Program Files\Launch Manager\CtrlVol.exe?x???0???????????0???A??|???????|???|???????|????????L???????PJ????F?????????????h?????????????B????????|@??|????=??|J?A?????????i?A?k?"U??B~??????F??b@?????????????? A??grU????i?A?{?@?@J??6m@?@J????"U??@?PJ?????
LaunchAp = C:\Program Files\Launch Manager\LaunchAp.exe????0???????????0???A??|???????|???|???????|????????L???????PJ????F?????????????h?????????????B????????|@??|????=??|J?A?????????i?A?k?"U??B~??????F??b@?????????????? A??grU????i?A?{?@?@J??6m@?@J????"U??@?PJ?????
Wbutton = C:\Program Files\Launch Manager\WButton.exe?????0???????????0???A??|???????|???|???????|????????L???????PJ????F?????????????h?????????????B????????|@??|????=??|J?A?????????i?A?k?"U??B~??????F??b@?????????????? A??grU????i?A?{?@?@J??6m@?@J????"U??@?PJ?????
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-08-21 8:49:15
ComboFix-quarantined-files.txt 2008-08-21 04:49:11
ComboFix2.txt 2008-08-20 14:32:57
Pre-Run: 25,889,189,888 bytes free
Post-Run: 25,878,478,848 bytes free
191