rendered paste bodyComboFix 07-10-07.2 - gg 2007-10-08 10:18:24.2 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.309 [GMT -5:00]
Running from: C:\Documents and Settings\gg\Desktop\spyware stuff\ComboFix.exe
Command switches used :: C:\Documents and Settings\gg\My Documents\CFScript.txt
* Created a new restore point
FILE::
C:\WINDOWS\SYSTEM32\netmanm.dll
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\VundoFix Backups
C:\VundoFix Backups\hgggdeb.dll.bad
C:\VundoFix Backups\netmanm.dll.bad
C:\VundoFix Backups\pmnomkk.dll.bad
C:\VundoFix Backups\xxyxuut.dll.bad
C:\WINDOWS\SYSTEM32\netmanm.dll
.
((((((((((((((((((((((((( Files Created from 2007-09-08 to 2007-10-08 )))))))))))))))))))))))))))))))
.
2007-10-07 12:25 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-06 22:20 <DIR> d-------- C:\Documents and Settings\gg\Application Data\Leadertech
2007-10-06 16:20 22,752 --a------ C:\WINDOWS\SYSTEM32\spupdsvc.exe
2007-10-06 16:20 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-10-06 16:19 7,680 --------- C:\WINDOWS\SYSTEM32\dllcache\bitsprx2.dll
2007-10-06 16:19 7,680 --------- C:\WINDOWS\SYSTEM32\bitsprx2.dll
2007-10-06 16:19 7,168 --------- C:\WINDOWS\SYSTEM32\dllcache\bitsprx3.dll
2007-10-06 16:19 7,168 --------- C:\WINDOWS\SYSTEM32\bitsprx3.dll
2007-10-06 16:19 331,776 --a------ C:\WINDOWS\SYSTEM32\winhttp.dll
2007-10-06 16:19 17,408 --a------ C:\WINDOWS\SYSTEM32\qmgrprxy.dll
2007-10-06 16:19 158,720 --------- C:\WINDOWS\SYSTEM32\xpob2res.dll
2007-10-06 16:19 <DIR> d-------- C:\WINDOWS\SYSTEM32\bits
2007-10-06 16:17 549,720 --a------ C:\WINDOWS\SYSTEM32\wuapi.dll
2007-10-06 16:17 43,352 --a------ C:\WINDOWS\SYSTEM32\wups2.dll
2007-10-06 16:17 33,624 --a------ C:\WINDOWS\SYSTEM32\wups.dll
2007-10-06 16:17 325,976 --a------ C:\WINDOWS\SYSTEM32\wucltui.dll
2007-10-06 11:23 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2007-10-06 11:23 <DIR> d-------- C:\WINDOWS\ehome
2007-10-06 11:13 2,028,640 --a------ C:\sp1aexpress_usa.exe
2007-10-03 00:12 <DIR> d-------- C:\Program Files\ToniArts
2007-10-02 22:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google
2007-10-02 22:01 <DIR> d-------- C:\Program Files\backups
2007-09-30 19:55 34,816 --a------ C:\WINDOWS\SYSTEM32\dllcache\admwprox.dll
2007-09-30 19:52 73,728 --a------ C:\WINDOWS\SYSTEM32\dllcache\icwtutor.exe
2007-09-30 19:52 61,440 --a------ C:\WINDOWS\SYSTEM32\dllcache\icwres.dll
2007-09-30 19:52 57,344 --a------ C:\WINDOWS\SYSTEM32\dllcache\icwconn.dll
2007-09-30 19:52 45,056 --a------ C:\WINDOWS\SYSTEM32\dllcache\icwutil.dll
2007-09-30 19:52 40,960 --a------ C:\WINDOWS\SYSTEM32\dllcache\trialoc.dll
2007-09-30 19:52 24,576 --a------ C:\WINDOWS\SYSTEM32\dllcache\icwrmind.exe
2007-09-30 19:52 155,648 --a------ C:\WINDOWS\SYSTEM32\dllcache\icwhelp.dll
2007-09-30 19:47 153,631 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\el90xnd5.sys
2007-09-30 19:45 24,661 --a------ C:\WINDOWS\SYSTEM32\spxcoins.dll
2007-09-30 19:45 24,661 --a------ C:\WINDOWS\SYSTEM32\dllcache\spxcoins.dll
2007-09-30 19:45 13,312 --a------ C:\WINDOWS\SYSTEM32\irclass.dll
2007-09-30 19:45 13,312 --a------ C:\WINDOWS\SYSTEM32\dllcache\irclass.dll
2007-09-30 19:10 <DIR> d--hs---- C:\FOUND.051
2007-09-30 18:52 <DIR> d--hs---- C:\FOUND.050
2007-09-30 18:28 1,046 --a------ C:\WINDOWS\SYSTEM32\dfrgresk.dll
2007-09-30 18:28 1,046 --a------ C:\WINDOWS\SYSTEM32\apphelpv.dll
2007-09-30 18:27 246,545 --a------ C:\WINDOWS\SYSTEM32\libssl32.dll
2007-09-30 18:27 1,188,375 --a------ C:\WINDOWS\SYSTEM32\libeay32.dll
2007-09-30 17:06 741,632 --a------ C:\WINDOWS\SYSTEM32\axaadgua.dat
2007-09-30 17:06 35,584 --a------ C:\WINDOWS\SYSTEM32\blursnbw.dat
2007-09-30 17:06 34,560 --a------ C:\WINDOWS\SYSTEM32\hzihaumx.dat
2007-09-30 17:06 118,528 --a------ C:\WINDOWS\SYSTEM32\ksusyvoa.dat
2007-09-30 17:01 5,120 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\chcibkdz.dat
2007-09-30 17:01 17,664 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\kvlaxgws.dat
2007-09-30 17:01 <DIR> d-------- C:\WINDOWS\SYSTEM32\AppCert
2007-09-30 17:00 91,136 --a------ C:\WINDOWS\SYSTEM32\netmanm.dll
2007-09-30 16:59 92,160 --a------ C:\WINDOWS\SYSTEM32\advpackn.dll
2007-09-15 20:38 <DIR> d-------- C:\Program Files\City Interactive
2007-09-15 20:27 <DIR> d--hs---- C:\FOUND.049
2007-09-14 11:02 <DIR> d--hs---- C:\FOUND.048
2007-09-09 09:08 <DIR> d--hs---- C:\FOUND.047
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-07-30 19:19 92504 --a------ C:\WINDOWS\SYSTEM32\dllcache\cdm.dll
2007-07-30 19:19 92504 --a------ C:\WINDOWS\SYSTEM32\cdm.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\SYSTEM32\wuauclt.exe
2007-07-30 19:19 53080 --a------ C:\WINDOWS\SYSTEM32\dllcache\wuauclt.exe
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\SYSTEM32\wuaueng.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\SYSTEM32\dllcache\wuaueng.dll
2006-03-28 09:49 1381 --a------ C:\Program Files\hijackthis.log
2006-03-26 18:15 271 ---hs---- C:\Program Files\desktop.ini
2006-03-26 18:15 23357 ---h----- C:\Program Files\folder.htt
2005-02-16 11:06 218112 --a------ C:\Program Files\HijackThis.exe
.
((((((((((((((((((((((((((((( snapshot@2007-10-07_12.34.37.31 )))))))))))))))))))))))))))))))))))))))))
.
----a-w 50,532 2007-10-08 15:12:06 C:\WINDOWS\SYSTEM32\perfc009.dat
----a-w 374,064 2007-10-08 15:12:06 C:\WINDOWS\SYSTEM32\perfh009.dat
----a-w 372,736 2007-10-08 15:18:20 C:\WINDOWS\SYSTEM32\config\systemprofile\ntuser.dat
----a-w 32,768 2007-10-08 15:10:42 C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\History\History.IE5\index.dat
----a-w 49,152 2007-10-08 15:10:42 C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
----a-w 32,768 2007-10-08 15:10:42 C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\index.dat
.
----a-w 50,532 2007-10-07 04:11:38 C:\WINDOWS\SYSTEM32\perfc009.dat
----a-w 374,064 2007-10-07 04:11:38 C:\WINDOWS\SYSTEM32\perfh009.dat
----a-w 372,736 2007-10-07 17:26:32 C:\WINDOWS\SYSTEM32\config\systemprofile\ntuser.dat
----a-w 32,768 2007-10-07 17:23:16 C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\History\History.IE5\index.dat
----a-w 49,152 2007-10-07 17:23:16 C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
----a-w 32,768 2007-10-07 17:23:16 C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{460EF089-7F9E-427A-BE1F-72587251EF40}]
2007-10-08 10:20 91136 --a------ c:\windows\system32\netmanm.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"@"="" []
"Motive SmartBridge"="C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [2005-08-24 07:51]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-03-09 15:29]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41]
"nwiz"="nwiz.exe" [2006-03-09 15:29 C:\WINDOWS\SYSTEM32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2006-03-09 15:29]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"@"="" []
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 01:04]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wuhausyx]
netmanm.dll 2007-10-08 10:20 91136 C:\WINDOWS\SYSTEM32\netmanm.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AT&T Self Support Tool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AT&T Self Support Tool.lnk
backup=C:\WINDOWS\pss\AT&T Self Support Tool.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=C:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Program Files\Ahead\InCD\InCD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
R0 BsStor;InCD Storage Helper Driver;C:\WINDOWS\System32\DRIVERS\bsstor.sys
R2 BsUDF;InCD UDF Driver;C:\WINDOWS\System32\drivers\BsUDF.sys
R2 dtaioade;3Com EtherLink XL 90X Adapter Controller;C:\WINDOWS\System32\svchost.exe -k netsvcs
R2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe
R3 EL90X;3Com EtherLink XL 90X Adapter Driver;C:\WINDOWS\System32\DRIVERS\el90xnd5.sys
R3 wdm_opl3sax;YAMAHA OPL3-SAx Audio Driver (WDM);C:\WINDOWS\System32\drivers\opl3sax.sys
S3 cdiskdun;cdiskdun;\??\C:\DOCUME~1\gg\LOCALS~1\Temp\cdiskdun.sys
S3 Ptserlp;PCTEL Serial Device Driver for PCI;C:\WINDOWS\System32\DRIVERS\ptserlp.sys
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
dtaioade
.
Contents of the 'Scheduled Tasks' folder
"2007-10-07 04:00:02 C:\WINDOWS\Tasks\Tune-up Application Start.job"
"2007-10-08 04:51:04 C:\WINDOWS\Tasks\PCHealth Scheduler for Data Collection.job"
"2007-10-08 04:01:00 C:\WINDOWS\Tasks\Uninstall Expiration Reminder.job"
- C:\WINDOWS\System32\OOBE\oobebaln.exe
.
**************************************************************************
catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-08 10:22:04
Windows 5.1.2600 Service Pack 1 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-10-08 10:25:06 - machine was rebooted
C:\ComboFix2.txt ... 2007-10-07 12:35
C:\ComboFix-quarantined-files.txt ... 2007-10-08 10:25
.
--- E O F ---