spaguy
Topic Starter
I'm not sure I'm posting correctly, I've surfed the site for a bit and downloaded ComboFix…I just can't open outlook and several other programs on my sys since getting hit with anitspywarexp2009. I downloaded Malawarebytes to get rid of the virus but that's when my problems began.
Please someone help…I've posted this twice but again, I'm not sure I'm even doing that correctly.
ComboFix 08-10-29.06 - Owner 2008-10-29 9:28:30.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.689 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Owner\Cookies\anolisybo._sy
C:\Documents and Settings\Owner\Cookies\ogad.db
C:\Documents and Settings\Owner\Cookies\pydow.reg
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\system32\av.dat
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
——-\Legacy_SERV-U
——-\Legacy_TDSSSERV.SYS)
——-\Service_Serv-U
——-\Service_TDSSserv.sys)
((((((((((((((((((((((((( Files Created from 2008-09-28 to 2008-10-29 )))))))))))))))))))))))))))))))
.
2008-10-29 09:16 . 2008-10-29 09:16 d——– C:\WINDOWS\Sun
2008-10-29 09:16 . 2008-10-29 09:16 d——– C:\Program Files\CCleaner
2008-10-28 07:57 . 2008-10-29 09:15 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-10-28 07:56 . 2008-10-29 09:15 d——– C:\Program Files\Yahoo!
2008-10-25 13:18 . 2008-10-29 09:15 d——– C:\Documents and Settings\Owner\.housecall6.6
2008-10-25 13:18 . 2005-04-13 03:48 49,265 –a—— C:\WINDOWS\SYSTEM32\jpicpl32.cpl
2008-10-25 13:17 . 2008-10-29 09:16 d——– C:\Program Files\Java
2008-10-25 13:16 . 2008-10-25 13:16 d——– C:\Program Files\Common Files\Java
2008-10-25 13:04 . 2008-10-29 09:16 d——– C:\Program Files\RegCure
2008-10-24 18:18 . 2008-10-24 18:18 61,440 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\degafm.sys
2008-10-24 17:08 . 2008-10-24 17:08 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-10-24 17:08 . 2008-10-24 17:08 d——– C:\Documents and Settings\Owner\Application Data\Malwarebytes
2008-10-24 17:08 . 2008-10-24 17:08 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-24 17:08 . 2008-10-22 16:10 38,496 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-10-24 17:08 . 2008-10-22 16:10 15,504 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
2008-10-24 14:14 . 2008-10-24 14:14 719 –a—— C:\WINDOWS\Sysvxd.exe
2008-10-24 12:37 . 2008-10-24 12:37 19,836 –a—— C:\Documents and Settings\Owner\Application Data\awejofihe.dat
2008-10-24 12:37 . 2008-10-24 12:37 18,927 –a—— C:\Documents and Settings\Owner\Application Data\nabuwilyha.bat
2008-10-24 12:37 . 2008-10-24 12:37 17,176 –a—— C:\WINDOWS\ivehicotez.inf
2008-10-24 12:37 . 2008-10-24 12:37 16,571 –a—— C:\WINDOWS\kojuf.exe
2008-10-24 12:37 . 2008-10-24 12:37 16,089 –a—— C:\WINDOWS\getigyvahi.lib
2008-10-24 12:37 . 2008-10-24 12:37 15,374 –a—— C:\Documents and Settings\All Users\Application Data\rebavam.reg
2008-10-24 12:37 . 2008-10-24 12:37 13,191 –a—— C:\WINDOWS\uzyzyfa.scr
2008-10-24 12:37 . 2008-10-24 12:37 12,750 –a—— C:\WINDOWS\qanux.dat
2008-10-24 12:37 . 2008-10-24 12:37 12,262 –a—— C:\WINDOWS\furuji.vbs
2008-10-24 12:37 . 2008-10-24 12:37 12,246 –a—— C:\WINDOWS\SYSTEM32\wuxy.com
2008-10-24 12:37 . 2008-10-24 12:37 10,733 –a—— C:\WINDOWS\SYSTEM32\odacil.dll
2008-10-24 12:37 . 2008-10-24 12:37 10,523 –a—— C:\Documents and Settings\Owner\Application Data\xadesuwad.bat
2008-10-24 12:37 . 2008-10-24 12:37 10,253 –a—— C:\Documents and Settings\Owner\Application Data\ezekatequ.dat
2008-10-24 12:37 . 2008-10-24 12:37 10,117 –a—— C:\Documents and Settings\Owner\Application Data\fixulu.dll
2008-10-24 12:37 . 2008-10-24 12:37 10,001 –a—— C:\Documents and Settings\Owner\Application Data\simacyco.scr
2008-10-24 11:10 . 2001-08-18 06:00 235,520 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\mssoap1.dll
2008-10-24 11:10 . 2001-08-18 06:00 25,088 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wisc10.dll
2008-10-24 11:10 . 2001-08-18 06:00 23,552 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\mssoapr.dll
2008-10-24 11:03 . 2008-10-24 11:03 19,124 –a—— C:\WINDOWS\SYSTEM32\riryvugog.lib
2008-10-24 11:03 . 2008-10-24 11:03 19,072 –a—— C:\WINDOWS\SYSTEM32\imocebe.exe
2008-10-24 11:03 . 2008-10-24 11:03 18,631 –a—— C:\WINDOWS\ebicowodoh._sy
2008-10-24 11:03 . 2008-10-24 11:03 17,789 –a—— C:\WINDOWS\fimipely.ban
2008-10-24 11:03 . 2008-10-24 11:03 16,851 –a—— C:\WINDOWS\baxecy._dl
2008-10-24 11:03 . 2008-10-24 11:03 14,871 –a—— C:\WINDOWS\fimak.ban
2008-10-24 11:03 . 2008-10-24 11:03 12,323 –a—— C:\WINDOWS\umeqevyb.scr
2008-10-24 11:03 . 2008-10-24 11:03 11,509 –a—— C:\WINDOWS\otymixogy.inf
2008-10-24 11:03 . 2008-10-24 11:03 10,259 –a—— C:\WINDOWS\uvyf.com
2008-10-24 10:41 . 2008-10-24 10:41 164 –a—— C:\WINDOWS\SYSTEM32\TDSSosvd.dat
2008-10-24 02:19 . 2008-10-15 10:34 337,408 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\netapi32.dll
2008-10-16 03:05 . 2008-08-14 04:11 2,189,184 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ntoskrnl.exe
2008-10-16 03:05 . 2008-08-14 04:09 2,145,280 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ntkrnlmp.exe
2008-10-16 03:05 . 2008-08-14 03:33 2,066,048 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ntkrnlpa.exe
2008-10-16 03:05 . 2008-08-14 03:33 2,023,936 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ntkrpamp.exe
2008-10-16 03:05 . 2008-09-15 06:12 1,846,400 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\win32k.sys
2008-10-16 03:04 . 2008-09-08 04:41 333,824 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\srv.sys
2008-10-09 10:07 . 2008-10-09 10:07 d——– C:\WINDOWS\SYSTEM32\scripting
2008-10-09 10:07 . 2008-10-09 10:07 d——– C:\WINDOWS\SYSTEM32\en
2008-10-09 10:07 . 2008-10-09 10:07 d——– C:\WINDOWS\l2schemas
2008-10-09 08:48 . 2008-10-09 08:51 d——– C:\801f0f5ce00d025081
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-29 15:15 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-27 15:20 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-10-24 18:38 ——— d—–w C:\Program Files\Kodak
2008-10-24 17:13 ——— d—–w C:\Program Files\Windows Defender
2008-10-24 17:13 ——— d—–w C:\Program Files\Nevo
2008-10-24 17:13 ——— d—–w C:\Program Files\Microsoft Works
2008-10-24 17:13 ——— d—–w C:\Program Files\Microsoft ActiveSync
2008-10-24 17:13 ——— d—–w C:\Program Files\Lavasoft
2008-10-24 17:12 ——— d—–w C:\Program Files\HP
2008-10-24 17:10 ——— d—–w C:\Program Files\Dell Computer
2008-10-24 17:10 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-10-24 17:09 ——— d—–w C:\Program Files\Common Files\Adobe
2008-10-24 14:00 ——— d—–w C:\Documents and Settings\LocalService\Application Data\AVG7
2008-10-09 15:08 ——— d—–w C:\Documents and Settings\Owner\Application Data\AVG7
2008-09-08 10:41 333,824 —-a-w C:\WINDOWS\system32\drivers\srv.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-03 401491]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-19 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 126976]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-16 28672]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 241664]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 36975]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.CEGSM"= mobilev.acm
path=
backup=
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^EPSON Status Monitor 3 Environment Check.lnk]
backup=C:\WINDOWS\pss\EPSON Status Monitor 3 Environment Check.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NevoMedia Server.lnk]
backup=C:\WINDOWS\pss\NevoMedia Server.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
-ra—— 2007-03-01 10:37 2321600 C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2008-04-13 18:12 15360 C:\WINDOWS\SYSTEM32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\system32\\sessmgr.exe"=
R2 ARGUS;ARGUS;C:\WINDOWS\system32\drivers\ARGUS.sys [2003-08-19 65280]
R3 tj2knd5;Terayon Cable Modem (NDIS);C:\WINDOWS\system32\DRIVERS\tj2knd5.sys [2002-10-13 17616]
R3 tj2kunic;Terayon Cable Modem (WDM);C:\WINDOWS\system32\DRIVERS\tj2kunic.sys [2002-10-13 69680]
S3 ZD1211U(Linksys);Linksys Wireless-G USB Network Adapter Driver(Linksys);C:\WINDOWS\system32\DRIVERS\zd1211u.sys [ ]
S4 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.sys [2001-08-17 38144]
.
Contents of the 'Scheduled Tasks' folder
2008-10-28 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe []
2008-10-29 C:\WINDOWS\Tasks\MP Scheduled Scan.job
- C:\Program Files\Windows Defender\MpCmdRun.exe []
2008-10-29 C:\WINDOWS\Tasks\RegCure Program Check.job
- C:\Program Files\RegCure\RegCure.exe [2008-04-21 15:21]
2008-10-25 C:\WINDOWS\Tasks\RegCure.job
- C:\Program Files\RegCure\RegCure.exe [2008-04-21 15:21]
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-!AVG Anti-Spyware - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
HKLM-Run-AdaptecDirectCD - C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
HKU-Default-Run-AVG7_Run - C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe
HKU-Default-Run-DWQueuedReporting - c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe
MSConfigStartUp-Adobe Reader Speed Launcher - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-AVG7_CC - C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
MSConfigStartUp-iTunesHelper - C:\Program Files\iTunes\iTunesHelper.exe
MSConfigStartUp-QuickTime Task - C:\Program Files\QuickTime\qttask.exe
MSConfigStartUp-Simple Star PhotoShow Media Manager - C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
.
——- Supplementary Scan ——-
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com
R0 -: HKLM-Main,Start Page = hxxp://www.google.com
R1 -: HKCU-Internet Settings,ProxyOverride = localhost
O18 -: WinCE Filter: image/bmp - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
O18 -: WinCE Filter: image/gif - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
O18 -: WinCE Filter: image/jpeg - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
O18 -: WinCE Filter: image/xbm - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
O18 -: WinCE Filter: text/asp - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} -
O18 -: WinCE Filter: text/html - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} -
O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
O16 -: ppctlcab - hxxp://www.pestscan.com/scanner/ppctlcab.cab
C:\WINDOWS\Downloaded Program Files\OSD406.OSD
C:\WINDOWS\Downloaded Program Files\ppctl.dll
O16 -: {0884DBCD-21DC-433B-B538-31C7F2843462} - hxxp://68.70.102.3/WebCamX.cab
C:\WINDOWS\Downloaded Program Files\Webclient.inf
C:\WINDOWS\System32\MPG4C32.dll
C:\WINDOWS\System32\mpg4ds32.ax
C:\WINDOWS\System32\AvsCodec.dll
C:\WINDOWS\System32\Ijl15.dll
C:\WINDOWS\Downloaded Program Files\Webclient.ocx
O16 -: {192F9A01-8030-48CE-9BC6-B03DE3E613C6} - hxxps://www.peoplepc.com/ppcos/ISP60/Download/ppcwebi.cab
C:\WINDOWS\Downloaded Program Files\ppcwebi.inf
C:\WINDOWS\Downloaded Program Files\ppcwebi.6.5.3.9.dll
O16 -: {CA034DCC-A580-4333-B52F-15F98C42E04C} - hxxps://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
C:\WINDOWS\Downloaded Program Files\dwnldr.inf
C:\WINDOWS\Downloaded Program Files\dwnldr.dll
O16 -: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://66.168.50.248/activex/AMC.cab
C:\WINDOWS\Downloaded Program Files\setup.inf
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-29 09:33:26
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\SYSTEM32\RioMSC.exe
C:\WINDOWS\SYSTEM32\ScsiAccess.EXE
C:\WINDOWS\SYSTEM32\fxssvc.exe
C:\Program Files\Java\jre1.5.0_03\bin\jucheck.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\WINDOWS\SYSTEM32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-10-29 9:38:29 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-29 15:38:24
Pre-Run: 59,175,718,912 bytes free
Post-Run: 59,307,360,256 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
232 — E O F — 2008-10-24 09:01:25
Please someone help…I've posted this twice but again, I'm not sure I'm even doing that correctly.
ComboFix 08-10-29.06 - Owner 2008-10-29 9:28:30.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.689 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Owner\Cookies\anolisybo._sy
C:\Documents and Settings\Owner\Cookies\ogad.db
C:\Documents and Settings\Owner\Cookies\pydow.reg
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\system32\av.dat
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
——-\Legacy_SERV-U
——-\Legacy_TDSSSERV.SYS)
——-\Service_Serv-U
——-\Service_TDSSserv.sys)
((((((((((((((((((((((((( Files Created from 2008-09-28 to 2008-10-29 )))))))))))))))))))))))))))))))
.
2008-10-29 09:16 . 2008-10-29 09:16 d——– C:\WINDOWS\Sun
2008-10-29 09:16 . 2008-10-29 09:16 d——– C:\Program Files\CCleaner
2008-10-28 07:57 . 2008-10-29 09:15 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-10-28 07:56 . 2008-10-29 09:15 d——– C:\Program Files\Yahoo!
2008-10-25 13:18 . 2008-10-29 09:15 d——– C:\Documents and Settings\Owner\.housecall6.6
2008-10-25 13:18 . 2005-04-13 03:48 49,265 –a—— C:\WINDOWS\SYSTEM32\jpicpl32.cpl
2008-10-25 13:17 . 2008-10-29 09:16 d——– C:\Program Files\Java
2008-10-25 13:16 . 2008-10-25 13:16 d——– C:\Program Files\Common Files\Java
2008-10-25 13:04 . 2008-10-29 09:16 d——– C:\Program Files\RegCure
2008-10-24 18:18 . 2008-10-24 18:18 61,440 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\degafm.sys
2008-10-24 17:08 . 2008-10-24 17:08 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-10-24 17:08 . 2008-10-24 17:08 d——– C:\Documents and Settings\Owner\Application Data\Malwarebytes
2008-10-24 17:08 . 2008-10-24 17:08 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-24 17:08 . 2008-10-22 16:10 38,496 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-10-24 17:08 . 2008-10-22 16:10 15,504 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
2008-10-24 14:14 . 2008-10-24 14:14 719 –a—— C:\WINDOWS\Sysvxd.exe
2008-10-24 12:37 . 2008-10-24 12:37 19,836 –a—— C:\Documents and Settings\Owner\Application Data\awejofihe.dat
2008-10-24 12:37 . 2008-10-24 12:37 18,927 –a—— C:\Documents and Settings\Owner\Application Data\nabuwilyha.bat
2008-10-24 12:37 . 2008-10-24 12:37 17,176 –a—— C:\WINDOWS\ivehicotez.inf
2008-10-24 12:37 . 2008-10-24 12:37 16,571 –a—— C:\WINDOWS\kojuf.exe
2008-10-24 12:37 . 2008-10-24 12:37 16,089 –a—— C:\WINDOWS\getigyvahi.lib
2008-10-24 12:37 . 2008-10-24 12:37 15,374 –a—— C:\Documents and Settings\All Users\Application Data\rebavam.reg
2008-10-24 12:37 . 2008-10-24 12:37 13,191 –a—— C:\WINDOWS\uzyzyfa.scr
2008-10-24 12:37 . 2008-10-24 12:37 12,750 –a—— C:\WINDOWS\qanux.dat
2008-10-24 12:37 . 2008-10-24 12:37 12,262 –a—— C:\WINDOWS\furuji.vbs
2008-10-24 12:37 . 2008-10-24 12:37 12,246 –a—— C:\WINDOWS\SYSTEM32\wuxy.com
2008-10-24 12:37 . 2008-10-24 12:37 10,733 –a—— C:\WINDOWS\SYSTEM32\odacil.dll
2008-10-24 12:37 . 2008-10-24 12:37 10,523 –a—— C:\Documents and Settings\Owner\Application Data\xadesuwad.bat
2008-10-24 12:37 . 2008-10-24 12:37 10,253 –a—— C:\Documents and Settings\Owner\Application Data\ezekatequ.dat
2008-10-24 12:37 . 2008-10-24 12:37 10,117 –a—— C:\Documents and Settings\Owner\Application Data\fixulu.dll
2008-10-24 12:37 . 2008-10-24 12:37 10,001 –a—— C:\Documents and Settings\Owner\Application Data\simacyco.scr
2008-10-24 11:10 . 2001-08-18 06:00 235,520 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\mssoap1.dll
2008-10-24 11:10 . 2001-08-18 06:00 25,088 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\wisc10.dll
2008-10-24 11:10 . 2001-08-18 06:00 23,552 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\mssoapr.dll
2008-10-24 11:03 . 2008-10-24 11:03 19,124 –a—— C:\WINDOWS\SYSTEM32\riryvugog.lib
2008-10-24 11:03 . 2008-10-24 11:03 19,072 –a—— C:\WINDOWS\SYSTEM32\imocebe.exe
2008-10-24 11:03 . 2008-10-24 11:03 18,631 –a—— C:\WINDOWS\ebicowodoh._sy
2008-10-24 11:03 . 2008-10-24 11:03 17,789 –a—— C:\WINDOWS\fimipely.ban
2008-10-24 11:03 . 2008-10-24 11:03 16,851 –a—— C:\WINDOWS\baxecy._dl
2008-10-24 11:03 . 2008-10-24 11:03 14,871 –a—— C:\WINDOWS\fimak.ban
2008-10-24 11:03 . 2008-10-24 11:03 12,323 –a—— C:\WINDOWS\umeqevyb.scr
2008-10-24 11:03 . 2008-10-24 11:03 11,509 –a—— C:\WINDOWS\otymixogy.inf
2008-10-24 11:03 . 2008-10-24 11:03 10,259 –a—— C:\WINDOWS\uvyf.com
2008-10-24 10:41 . 2008-10-24 10:41 164 –a—— C:\WINDOWS\SYSTEM32\TDSSosvd.dat
2008-10-24 02:19 . 2008-10-15 10:34 337,408 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\netapi32.dll
2008-10-16 03:05 . 2008-08-14 04:11 2,189,184 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ntoskrnl.exe
2008-10-16 03:05 . 2008-08-14 04:09 2,145,280 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ntkrnlmp.exe
2008-10-16 03:05 . 2008-08-14 03:33 2,066,048 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ntkrnlpa.exe
2008-10-16 03:05 . 2008-08-14 03:33 2,023,936 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ntkrpamp.exe
2008-10-16 03:05 . 2008-09-15 06:12 1,846,400 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\win32k.sys
2008-10-16 03:04 . 2008-09-08 04:41 333,824 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\srv.sys
2008-10-09 10:07 . 2008-10-09 10:07 d——– C:\WINDOWS\SYSTEM32\scripting
2008-10-09 10:07 . 2008-10-09 10:07 d——– C:\WINDOWS\SYSTEM32\en
2008-10-09 10:07 . 2008-10-09 10:07 d——– C:\WINDOWS\l2schemas
2008-10-09 08:48 . 2008-10-09 08:51 d——– C:\801f0f5ce00d025081
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-29 15:15 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-27 15:20 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-10-24 18:38 ——— d—–w C:\Program Files\Kodak
2008-10-24 17:13 ——— d—–w C:\Program Files\Windows Defender
2008-10-24 17:13 ——— d—–w C:\Program Files\Nevo
2008-10-24 17:13 ——— d—–w C:\Program Files\Microsoft Works
2008-10-24 17:13 ——— d—–w C:\Program Files\Microsoft ActiveSync
2008-10-24 17:13 ——— d—–w C:\Program Files\Lavasoft
2008-10-24 17:12 ——— d—–w C:\Program Files\HP
2008-10-24 17:10 ——— d—–w C:\Program Files\Dell Computer
2008-10-24 17:10 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-10-24 17:09 ——— d—–w C:\Program Files\Common Files\Adobe
2008-10-24 14:00 ——— d—–w C:\Documents and Settings\LocalService\Application Data\AVG7
2008-10-09 15:08 ——— d—–w C:\Documents and Settings\Owner\Application Data\AVG7
2008-09-08 10:41 333,824 —-a-w C:\WINDOWS\system32\drivers\srv.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-03 401491]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-19 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 126976]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-16 28672]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 241664]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 36975]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.CEGSM"= mobilev.acm
path=
backup=
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^EPSON Status Monitor 3 Environment Check.lnk]
backup=C:\WINDOWS\pss\EPSON Status Monitor 3 Environment Check.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NevoMedia Server.lnk]
backup=C:\WINDOWS\pss\NevoMedia Server.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
-ra—— 2007-03-01 10:37 2321600 C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2008-04-13 18:12 15360 C:\WINDOWS\SYSTEM32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\system32\\sessmgr.exe"=
R2 ARGUS;ARGUS;C:\WINDOWS\system32\drivers\ARGUS.sys [2003-08-19 65280]
R3 tj2knd5;Terayon Cable Modem (NDIS);C:\WINDOWS\system32\DRIVERS\tj2knd5.sys [2002-10-13 17616]
R3 tj2kunic;Terayon Cable Modem (WDM);C:\WINDOWS\system32\DRIVERS\tj2kunic.sys [2002-10-13 69680]
S3 ZD1211U(Linksys);Linksys Wireless-G USB Network Adapter Driver(Linksys);C:\WINDOWS\system32\DRIVERS\zd1211u.sys [ ]
S4 hpt3xx;hpt3xx;C:\WINDOWS\system32\DRIVERS\hpt3xx.sys [2001-08-17 38144]
.
Contents of the 'Scheduled Tasks' folder
2008-10-28 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe []
2008-10-29 C:\WINDOWS\Tasks\MP Scheduled Scan.job
- C:\Program Files\Windows Defender\MpCmdRun.exe []
2008-10-29 C:\WINDOWS\Tasks\RegCure Program Check.job
- C:\Program Files\RegCure\RegCure.exe [2008-04-21 15:21]
2008-10-25 C:\WINDOWS\Tasks\RegCure.job
- C:\Program Files\RegCure\RegCure.exe [2008-04-21 15:21]
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-!AVG Anti-Spyware - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
HKLM-Run-AdaptecDirectCD - C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
HKU-Default-Run-AVG7_Run - C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe
HKU-Default-Run-DWQueuedReporting - c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe
MSConfigStartUp-Adobe Reader Speed Launcher - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-AVG7_CC - C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
MSConfigStartUp-iTunesHelper - C:\Program Files\iTunes\iTunesHelper.exe
MSConfigStartUp-QuickTime Task - C:\Program Files\QuickTime\qttask.exe
MSConfigStartUp-Simple Star PhotoShow Media Manager - C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
.
——- Supplementary Scan ——-
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com
R0 -: HKLM-Main,Start Page = hxxp://www.google.com
R1 -: HKCU-Internet Settings,ProxyOverride = localhost
O18 -: WinCE Filter: image/bmp - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
O18 -: WinCE Filter: image/gif - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
O18 -: WinCE Filter: image/jpeg - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
O18 -: WinCE Filter: image/xbm - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
O18 -: WinCE Filter: text/asp - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} -
O18 -: WinCE Filter: text/html - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} -
O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
O16 -: ppctlcab - hxxp://www.pestscan.com/scanner/ppctlcab.cab
C:\WINDOWS\Downloaded Program Files\OSD406.OSD
C:\WINDOWS\Downloaded Program Files\ppctl.dll
O16 -: {0884DBCD-21DC-433B-B538-31C7F2843462} - hxxp://68.70.102.3/WebCamX.cab
C:\WINDOWS\Downloaded Program Files\Webclient.inf
C:\WINDOWS\System32\MPG4C32.dll
C:\WINDOWS\System32\mpg4ds32.ax
C:\WINDOWS\System32\AvsCodec.dll
C:\WINDOWS\System32\Ijl15.dll
C:\WINDOWS\Downloaded Program Files\Webclient.ocx
O16 -: {192F9A01-8030-48CE-9BC6-B03DE3E613C6} - hxxps://www.peoplepc.com/ppcos/ISP60/Download/ppcwebi.cab
C:\WINDOWS\Downloaded Program Files\ppcwebi.inf
C:\WINDOWS\Downloaded Program Files\ppcwebi.6.5.3.9.dll
O16 -: {CA034DCC-A580-4333-B52F-15F98C42E04C} - hxxps://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
C:\WINDOWS\Downloaded Program Files\dwnldr.inf
C:\WINDOWS\Downloaded Program Files\dwnldr.dll
O16 -: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://66.168.50.248/activex/AMC.cab
C:\WINDOWS\Downloaded Program Files\setup.inf
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-29 09:33:26
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\SYSTEM32\RioMSC.exe
C:\WINDOWS\SYSTEM32\ScsiAccess.EXE
C:\WINDOWS\SYSTEM32\fxssvc.exe
C:\Program Files\Java\jre1.5.0_03\bin\jucheck.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\WINDOWS\SYSTEM32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-10-29 9:38:29 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-29 15:38:24
Pre-Run: 59,175,718,912 bytes free
Post-Run: 59,307,360,256 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
232 — E O F — 2008-10-24 09:01:25