rendered paste bodyComboFix 07-12-21.4 - Dan 2007-12-28 23:19:31.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.672 [GMT -5:00]
Running from: D:\Junk\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\x64
.
((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-29 )))))))))))))))))))))))))))))))
.
2007-12-21 02:00 . 2006-10-06 19:09 155,648 --a------ C:\WINDOWS\system32\igfxres.dll
2007-12-21 01:59 . 2007-12-21 01:59 <DIR> d-------- C:\WINDOWS\system32\Lang
2007-12-21 01:59 . 2006-10-06 22:19 200,704 --a------ C:\WINDOWS\system32\igfxCoIn_v4704.dll
2007-12-18 00:47 . 2007-12-18 00:47 <DIR> d-------- C:\Intel
2007-12-17 15:14 . 2007-12-17 15:15 626 --a------ C:\regfix.reg
2007-12-17 15:03 . 2007-12-17 15:03 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-12-17 15:03 . 2007-12-17 15:03 <DIR> d-------- C:\Documents and Settings\Dan\Application Data\SUPERAntiSpyware.com
2007-12-17 15:03 . 2007-12-17 15:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-12-16 21:14 . 2007-12-20 14:49 91,492 --a------ C:\WINDOWS\system32\drivers\klin.dat
2007-12-16 21:14 . 2007-12-16 21:20 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat
2007-12-16 21:13 . 2007-12-16 21:13 <DIR> d-------- C:\Program Files\Kaspersky Lab
2007-12-16 21:13 . 2007-12-28 23:22 89,006,880 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-12-16 21:13 . 2007-12-28 13:47 1,187,444 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2007-12-16 21:13 . 2007-12-28 23:22 138,016 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2007-12-16 21:13 . 2007-12-28 13:47 16,568 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2007-12-16 19:47 . 2007-12-16 19:47 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-12-15 13:42 . 2007-12-15 13:43 <DIR> d-------- C:\Program Files\RenGames
2007-12-07 04:13 . 2007-12-07 04:13 5,376 --a------ C:\WINDOWS\system32\drivers\MS1000.sys
2007-12-05 01:51 . 2002-08-12 12:51 4,227,072 --a------ C:\WINDOWS\system32\qt-mt305.dll
2007-12-04 10:41 . 2007-12-28 13:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-04 10:40 . 2007-12-04 10:40 <DIR> d-------- C:\KAV
2007-12-02 21:04 . 2007-12-16 17:05 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2007-12-02 17:40 . 2007-12-16 16:59 121 --a------ C:\WINDOWS\bdagent.INI
2007-12-02 17:39 . 2007-12-16 03:17 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2007-12-02 13:53 . 2007-12-04 11:25 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-12-02 13:49 . 2007-12-02 13:49 56,200 --ah----- C:\WINDOWS\system32\mlfcache.dat
2007-12-02 10:53 . 2007-12-02 10:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2007-12-01 22:51 . 2007-12-01 22:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Eset
2007-11-29 08:36 . 2007-11-29 08:36 <DIR> d-------- C:\Documents and Settings\Dan\Application Data\Media Player Classic
2007-11-29 06:56 . 2007-11-29 07:45 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb
2007-11-29 06:56 . 2007-11-29 07:45 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb
2007-11-29 06:44 . 2007-11-29 07:45 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2007-11-29 06:44 . 2006-10-04 09:06 1,197,294 --------- C:\WINDOWS\system32\dllcache\sysmain.sdb
2007-11-29 06:44 . 2006-10-04 09:06 764,868 --------- C:\WINDOWS\system32\dllcache\apph_sp.sdb
2007-11-29 06:44 . 2006-10-04 09:06 217,118 --------- C:\WINDOWS\system32\dllcache\apphelp.sdb
2007-11-29 06:42 . 2007-11-29 07:44 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2007-11-29 05:52 . 2007-11-29 05:52 <DIR> d-------- C:\Program Files\XP Codec Pack
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-28 18:14 --------- d-----w C:\Documents and Settings\Dan\Application Data\uTorrent
2007-12-28 10:03 --------- d-----w C:\Documents and Settings\Dan\Application Data\Skype
2007-12-28 07:54 --------- d-----w C:\Program Files\Google
2007-12-28 05:35 --------- d-----w C:\Program Files\PokerStars
2007-12-16 08:29 77,824 ----a-w C:\WINDOWS\system32\xcomm.dll
2007-12-05 06:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-29 00:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ahead
2007-11-29 00:26 --------- d-----w C:\Program Files\Common Files\Ahead
2007-11-29 00:24 --------- d-----w C:\Program Files\Nero
2007-11-29 00:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2007-11-28 10:33 3,532 ----a-w C:\drmHeader.bin
2007-11-26 03:30 --------- d-----w C:\Program Files\MSN Messenger
2007-11-22 03:26 --------- d-----w C:\Documents and Settings\Dan\Application Data\Microgaming
2007-11-16 10:03 69,689 ----a-w C:\WINDOWS\UNZIP.DLL
2007-11-16 10:03 507,904 ----a-w C:\WINDOWS\TMUPDATE.DLL
2007-11-16 10:03 286,720 ----a-w C:\WINDOWS\PATCH.EXE
2007-11-14 07:26 450,560 ------w C:\WINDOWS\system32\dllcache\jscript.dll
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-12 10:39 --------- d-----w C:\Program Files\delta
2007-11-12 10:02 --------- d-----w C:\Program Files\Common Files\Adobe
2007-11-11 10:56 881,152 ----a-w C:\WinRAR.exe
2007-11-08 09:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-08 09:47 --------- d-----w C:\Documents and Settings\Dan\Application Data\AdobeUM
2007-11-08 09:16 22 ----a-w C:\zipnew.dat
2007-11-08 09:16 20 ----a-w C:\rarnew.dat
2007-11-08 07:48 5,120 ----a-w C:\dllh0st.exe
2007-11-08 07:02 218,112 ----a-w C:\hijackthis.exe
2007-11-05 09:38 --------- d-----w C:\Documents and Settings\Dan\Application Data\Apple Computer
2007-11-05 09:35 --------- d-----w C:\Program Files\Apple Software Update
2007-11-05 09:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-10-30 09:55 3,065,856 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-10-30 09:04 --------- d-----w C:\Documents and Settings\Dan\Application Data\Corel
2007-10-29 22:35 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:35 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2007-10-28 11:19 --------- d-----w C:\Program Files\uTorrent
2007-10-28 02:15 102,664 ----a-w C:\WINDOWS\system32\drivers\tmcomm.sys
2007-10-27 22:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-27 22:40 222,720 ------w C:\WINDOWS\system32\dllcache\wmasf.dll
2007-10-26 03:34 8,460,288 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-11 05:57 96,256 ------w C:\WINDOWS\system32\dllcache\inseng.dll
2007-10-11 05:57 666,112 ------w C:\WINDOWS\system32\dllcache\wininet.dll
2007-10-11 05:57 617,984 ------w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-10-11 05:57 55,808 ------w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-10-11 05:57 532,480 ------w C:\WINDOWS\system32\dllcache\mstime.dll
2007-10-11 05:57 474,112 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll
2007-10-11 05:57 449,024 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-10-11 05:57 39,424 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-10-11 05:57 357,888 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-10-11 05:57 251,904 ------w C:\WINDOWS\system32\dllcache\iepeers.dll
2007-10-11 05:57 205,824 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-10-11 05:57 16,384 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-10-11 05:57 151,040 ------w C:\WINDOWS\system32\dllcache\cdfview.dll
2007-10-11 05:57 146,432 ------w C:\WINDOWS\system32\dllcache\msrating.dll
2007-10-11 05:57 1,498,112 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll
2007-10-11 05:57 1,054,208 ------w C:\WINDOWS\system32\dllcache\danim.dll
2007-10-11 05:57 1,024,000 ------w C:\WINDOWS\system32\dllcache\browseui.dll
2007-10-10 10:48 18,432 ------w C:\WINDOWS\system32\dllcache\iedw.exe
2007-06-23 21:46 87,608 ----a-w C:\Documents and Settings\Dan\Application Data\ezpinst.exe
2007-06-23 21:46 47,360 ----a-w C:\Documents and Settings\Dan\Application Data\pcouffin.sys
2005-08-08 17:40 483 ----a-w C:\Program Files\rarreg.key
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 06:00]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-06-28 12:51]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2005-09-26 19:34]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= D:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
D:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 D:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ymetray.lnk]
backup=C:\WINDOWS\pss\ymetray.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-10 19:51 39792 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-06-27 19:03 152872 --a------ C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BuildBU]
2004-02-19 08:23 61440 --a------ c:\dell\bldbubg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]
2006-08-14 15:20 462336 --a------ C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-10 06:00 15360 --a------ C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellHelp]
C:\Dell\DellHelp\DellHelp.exe /c
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
C:\Program Files\Dell Support\DSAgnt.exe /startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-09-08 06:20 122940 --a------ C:\WINDOWS\System32\DLA\DLACTRLW.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
2005-10-05 04:12 94208 --a------ C:\Program Files\Dell\Media Experience\DMXLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2005-09-29 15:01 67584 --a------ C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2006-10-06 19:13 114688 --a------ C:\WINDOWS\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2006-07-06 08:15 151552 --a------ C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2006-10-06 19:11 98304 --a------ C:\WINDOWS\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -start
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McRegWiz]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Update Services]
svhost32.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 15:57 153136 --a------ C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2006-10-06 19:10 94208 --a------ C:\WINDOWS\system32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
D:\Program Files\QuickTime\QTTask.exe -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1]
C:\WINDOWS\mrofinu904.exe 61A847B5BBF7281B329F284503996897C881250221C8670836AC4FA7C8833201749139
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
stsystra.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyHunter]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyHunter Security Suite]
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-03-14 02:43 83608 --a------ C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2007-06-21 14:06 1318912 --a------ D:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
C:\WINDOWS\system32\dumprep 0 -u
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Registry Repair Pro]
D:\Program Files\3B Software\Windows Registry Repair Pro\RegistryRepairPro.exe 4
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 14:58]
S3 MS1000;MS1000;C:\WINDOWS\system32\DRIVERS\MS1000.sys [2007-12-07 04:13]
S3 NAL;Nal Service ;C:\WINDOWS\system32\Drivers\iqvw32.sys [2006-06-05 04:39]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - D:\Program Files\ESET\Install\setup.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
**************************************************************************
catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-28 23:22:21
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\WINDOWS\WindowsShell.Manifest 749 bytes
C:\WINDOWS\WindowsUpdate.log 1867338 bytes
C:\WINDOWS\winhelp.exe 256192 bytes
C:\WINDOWS\winhlp32.exe 283648 bytes executable
C:\WINDOWS\wininit.ini 126 bytes
C:\WINDOWS\winnt.bmp 48680 bytes
C:\WINDOWS\winnt256.bmp 48680 bytes
C:\WINDOWS\WinSxS
C:\WINDOWS\WMFDist11.log 55015 bytes
C:\WINDOWS\WMFDist11Uninst.log 13888 bytes
C:\WINDOWS\wmp11.log 32832 bytes
C:\WINDOWS\wmp11Uninst.log 10317 bytes
C:\WINDOWS\wmsetup.log 167463 bytes
C:\WINDOWS\wmsetup10.log 5175 bytes
C:\WINDOWS\WMSysPr9.prx 316640 bytes
C:\WINDOWS\Wudf01000Inst.log 13920 bytes
C:\WINDOWS\XpsEPSC.log 30093 bytes
C:\WINDOWS\xpsp1hfm.log 1073 bytes
C:\WINDOWS\Zapotec.bmp 9522 bytes
C:\WINDOWS\_default.pif 707 bytes
scan completed successfully
hidden files: 20
**************************************************************************
.
Completion time: 2007-12-28 23:23:50
.
2007-12-22 00:07:07 --- E O F ---