Is this Box Clean?

So below is my log.

I keep a really clean box. Honestly, I do. No A/V, No firewall. Nothing. I'm barebones.

I download nothing untrusted. Anyhow–

Yesterday I downloaded something untrusted and whoops ;/ I think it had something in it. I cleaned with Combofix - or so I think.

Below are HJT and CF logs:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:47:04 PM, on 12/1/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1228148718765
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

–
End of file - 1980 bytes




I am not too concerned with my running processes, though I will certainly be stopping AdAware's service as soon as this post is complete. However, these strike fear in me:

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

IDriverT.exe is 72KB in size, and in that same folder are: IDriver.exe and IDriver2.exe both 756 KB in size. Seems odd.

Right after installing a program called mmbot from a third party source i began receiving popups in tabs in firefox. this has never happened to me in the 2+ years ive been using it - so i knew something was off. Combofix removed them successfully from the machine. They are listed in the deleted files list in ComboFix:

ComboFix 08-12-01.01 - Admin 2008-12-01 23:19:30.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.717 [GMT -5:00]
Running from: C:\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\izowuden.ini
c:\windows\system32\neduwozi.dll
c:\windows\system32\perakivu.dll
c:\windows\system32\qviexio3.dat
c:\windows\system32\reveraza.dll
c:\windows\system32\wobarale.dll

.
((((((((((((((((((((((((( Files Created from 2008-11-02 to 2008-12-02 )))))))))))))))))))))))))))))))
.

2008-12-01 23:13 . 2008-12-01 23:13 3,056,371 -ra—— C:\ComboFix.exe
2008-12-01 18:58 . 2008-12-01 18:58 d——– c:\program files\Lavasoft
2008-12-01 18:58 . 2008-12-01 18:58 d——– c:\documents and settings\All Users\Application Data\Lavasoft
2008-12-01 18:57 . 2008-12-01 18:57 d——– c:\program files\Common Files\Wise Installation Wizard
2008-12-01 18:56 . 2008-12-01 18:56 50,688 –a—— C:\ATF-Cleaner.exe
2008-12-01 18:51 . 2008-12-01 18:53 23,804,784 –a—— C:\aaw2008.exe
2008-12-01 18:36 . 2008-09-07 15:22 102,664 –a—— c:\windows\system32\drivers\tmcomm.sys
2008-12-01 14:49 . 2008-12-01 14:49 d——– c:\program files\Trend Micro
2008-12-01 14:38 . 2008-12-01 14:39 8,989,818 –a—— C:\mmBOT.546[1.3c].zip
2008-12-01 14:33 . 2008-12-01 14:33 d——– c:\windows\system32\scripting
2008-12-01 14:33 . 2008-12-01 14:33 d——– c:\windows\system32\en
2008-12-01 14:33 . 2008-12-01 14:33 d——– c:\windows\l2schemas
2008-12-01 11:36 . 2008-04-13 19:12 1,306,624 —–c— c:\windows\system32\dllcache\msxml6.dll
2008-12-01 11:24 . 2008-10-16 14:07 23,576 –a—— c:\windows\system32\wuapi.dll.mui
2008-11-30 23:49 . 2008-11-30 23:49 d——– c:\windows\mm.BOT
2008-11-30 23:48 . 2008-11-30 23:48 d——– C:\temp
2008-11-30 23:44 . 2008-11-30 23:49 d——– C:\mmBOT.546
2008-11-20 01:22 . 2008-11-20 01:22 41,150 –a—— c:\windows\system32\msratnit.dll
2008-11-20 01:22 . 2008-12-01 14:52 5,356 –a—— c:\windows\system32\comsatac.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-01 04:12 ——— d—–w c:\program files\Diablo II
2008-10-22 21:09 37,256 —-a-w c:\documents and settings\Admin\Application Data\GDIPFONTCACHEV1.DAT
2008-10-14 23:32 94,208 —-a-w c:\windows\DIIUnin.exe
2008-10-14 23:32 2,829 —-a-w c:\windows\DIIUnin.pif
2008-09-21 23:42 81,920 —-a-w c:\documents and settings\Admin\Application Data\ezpinst.exe
2008-09-21 23:42 47,360 —-a-w c:\documents and settings\Admin\Application Data\pcouffin.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VPN Client.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk
backup=c:\windows\pss\VPN Client.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2007-10-10 19:51 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2008-04-13 19:12 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\diagent]
–a—— 2002-04-03 01:01 135264 c:\program files\Creative\SBLive\Diagnostics\diagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
–a—— 2005-05-11 23:12 49152 c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2001-07-09 11:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-03-28 22:37 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
–a—— 2007-08-16 07:56 236016 c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
——— 2000-05-11 01:00 90112 c:\windows\Updreg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"CVPND"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

S2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\x:\program files\CyberLink\PowerDVD\000.fcl []
S4 WUSB54Gv42SVC;WUSB54Gv42SVC;"c:\program files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe" "WUSB54Gv42.exe" [2008-01-07 53307]
.
- - - - ORPHANS REMOVED - - - -

BHO-{01891881-b6e0-40d3-b660-c76839868763} - c:\windows\system32\sosafuji.dll
MSConfigStartUp-5c6a560c - c:\windows\system32\neduwozi.dll
MSConfigStartUp-CPM5f596590 - c:\windows\system32\wobarale.dll
MSConfigStartUp-gegezipibe - c:\windows\system32\perakivu.dll
MSConfigStartUp-LanguageShortcut - x:\program files\CyberLink\PowerDVD\Language\Language.exe
MSConfigStartUp-RemoteControl - x:\program files\CyberLink\PowerDVD\PDVDServ.exe


.
——- Supplementary Scan ——-
.
FireFox -: Profile - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\tvdwp9p7.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.com
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-01 23:21:33
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\x:\program files\CyberLink\PowerDVD\000.fcl"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(928)
c:\windows\system32\Ati2evxx.dll
.
———————— Other Running Processes ————————
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-12-01 23:23:05 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-02 04:22:51

Pre-Run: 75,387,842,560 bytes free
Post-Run: 75,704,406,016 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

141






Is she clean?