All pastes #839107 Raw Edit

Miscellany

public text v1 · immutable
#839107 ·published 2007-12-30 21:12 UTC
rendered paste body
ComboFix 07-12-21.4 - Me 2007-12-30 23:07:31.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.395 [GMT 2:00]
Running from: C:\Documents and Settings\Me\Desktop\ComboFix.exe
 * Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\Me\Application Data\installer_en[1].exe
C:\Documents and Settings\Me\Application Data\ShoppingReport
C:\Documents and Settings\Me\Application Data\ShoppingReport\cs\Config.xml
C:\Documents and Settings\Me\Application Data\ShoppingReport\cs\db\Aliases.dbs
C:\Documents and Settings\Me\Application Data\ShoppingReport\cs\db\Sites.dbs
C:\Documents and Settings\Me\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
C:\Documents and Settings\Me\Application Data\ShoppingReport\cs\report\aggr_storage.xml
C:\Documents and Settings\Me\Application Data\ShoppingReport\cs\report\send_storage.xml
C:\Documents and Settings\Me\Application Data\ShoppingReport\cs\res1\WhiteList.dbs
C:\Documents and Settings\Me\Desktop\installer_en.exe
C:\svchost2.exe
C:\WINDOWS\mssadv.dll

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DRIVER


(((((((((((((((((((((((((   Files Created from 2007-11-28 to 2007-12-30  )))))))))))))))))))))))))))))))
.

2007-12-30 22:33 . 2007-12-30 22:33	<DIR>	d--------	C:\Documents and Settings\Me\Application Data\TERMINAL Studio
2007-12-30 22:33 . 2007-12-30 22:33	664	--a------	C:\WINDOWS\system32\d3d9caps.dat
2007-12-30 22:15 . 2007-12-30 22:15	<DIR>	d--------	C:\Documents and Settings\Me\Application Data\Grisoft
2007-12-30 22:15 . 2007-12-30 22:15	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-30 22:15 . 2007-05-30 14:10	10,872	--a------	C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-12-30 21:29 . 2007-12-30 21:29	<DIR>	d--------	C:\WINDOWS\ERUNT
2007-12-30 20:36 . 2007-12-30 20:36	<DIR>	d--------	C:\Program Files\Trend Micro
2007-12-30 17:26 . 2004-08-03 23:08	26,496	--a--c---	C:\WINDOWS\system32\dllcache\usbstor.sys
2007-12-30 17:25 . 2004-08-03 23:08	142,976	--a------	C:\WINDOWS\system32\drivers\usbport.sys
2007-12-30 17:25 . 2004-08-03 23:08	142,976	--a--c---	C:\WINDOWS\system32\dllcache\usbport.sys
2007-12-30 17:25 . 2004-08-04 00:56	74,240	--a------	C:\WINDOWS\system32\usbui.dll
2007-12-30 17:25 . 2004-08-04 00:56	74,240	--a--c---	C:\WINDOWS\system32\dllcache\usbui.dll
2007-12-30 17:25 . 2004-08-03 23:08	57,600	--a------	C:\WINDOWS\system32\drivers\usbhub.sys
2007-12-30 17:25 . 2004-08-03 23:08	57,600	--a--c---	C:\WINDOWS\system32\dllcache\usbhub.sys
2007-12-30 17:25 . 2004-08-03 23:08	17,024	--a------	C:\WINDOWS\system32\drivers\usbohci.sys
2007-12-30 17:25 . 2004-08-03 23:08	17,024	--a--c---	C:\WINDOWS\system32\dllcache\usbohci.sys
2007-12-30 17:25 . 2001-08-17 14:03	4,736	--a------	C:\WINDOWS\system32\drivers\usbd.sys
2007-12-30 17:25 . 2001-08-17 14:03	4,736	--a--c---	C:\WINDOWS\system32\dllcache\usbd.sys
2007-12-30 17:21 . 2007-11-06 17:46	106,496	--a------	C:\WINDOWS\system32\Astro Gemini Screensaver Manager.scr
2007-12-30 17:20 . 2007-12-30 17:20	<DIR>	d--------	C:\Program Files\Astro Gemini Software
2007-12-30 17:20 . 2007-12-30 17:20	<DIR>	d--------	C:\Documents and Settings\Me\Application Data\Astro Gemini Software
2007-12-30 17:20 . 2007-12-12 16:31	11,808,768	--a------	C:\WINDOWS\system32\Wild West 3D Screensaver.scr
2007-12-30 17:20 . 2007-12-30 17:20	552	--a------	C:\WINDOWS\system32\d3d8caps.dat
2007-12-30 17:15 . 2007-12-30 17:15	<DIR>	d--------	C:\Program Files\Fish Aquarium 3D Screensaver
2007-12-30 17:15 . 2007-12-30 17:15	<DIR>	d--------	C:\Program Files\Avira
2007-12-30 17:15 . 2007-12-30 17:15	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Avira
2007-12-30 17:15 . 2005-07-26 12:40	7,487,488	--a------	C:\WINDOWS\system32\Fish Aquarium 3D Screensaver.scr
2007-12-30 17:15 . 2007-12-30 17:15	3,720	--a------	C:\WINDOWS\system32\Fish Aquarium 3D Screensaver.html
2007-12-30 16:34 . 2007-12-30 16:34	<DIR>	d--------	C:\Program Files\Alwil Software
2007-12-30 15:55 . 2007-12-30 15:55	79,872	---h-----	C:\Documents and Settings\Me\Me.exe
2007-12-30 15:55 . 2007-12-30 15:55	79,872	---hs----	C:\B47428B0.exe
2007-12-30 04:17 . 2007-12-30 04:17	<DIR>	d--------	C:\Program Files\Ace Zip
2007-12-30 04:17 . 2004-03-24 00:48	1,097,728	--a------	C:\WINDOWS\system32\chilkatZip2.dll
2007-12-30 04:17 . 2004-03-24 00:46	569,344	--a------	C:\WINDOWS\system32\Zip2Exe.dll
2007-12-30 04:17 . 2004-03-24 00:46	438,272	--a------	C:\WINDOWS\system32\ChilkatUtil.dll
2007-12-30 04:17 . 1999-07-15 12:11	122,880	--a------	C:\WINDOWS\system32\sgFileSys.dll
2007-12-30 04:17 . 2000-10-02 00:00	102,160	--a------	C:\WINDOWS\system32\VB6CHT.DLL
2007-12-30 04:17 . 2001-01-16 00:00	101,888	--a------	C:\WINDOWS\system32\VB6STKIT.DLL
2007-12-30 04:17 . 2007-01-09 10:17	62,976	--a------	C:\WINDOWS\system32\shdocvw.oca
2007-12-30 04:17 . 2005-01-07 22:47	40,960	--a------	C:\WINDOWS\system32\mspregistry.dll
2007-12-30 04:17 . 1998-07-06 00:00	28,160	--a------	C:\WINDOWS\system32\CMDLGCHT.DLL
2007-12-30 04:17 . 2001-10-10 11:08	20,530	--a------	C:\WINDOWS\system32\scrrncht.dll
2007-12-30 04:12 . 2007-12-30 04:12	<DIR>	d--------	C:\Documents and Settings\Me\Application Data\ConfidentSurf
2007-12-30 04:07 . 2007-12-30 04:07	<DIR>	d--------	C:\Program Files\Common Files\ConfidentSurf
2007-12-30 04:07 . 2007-12-30 04:07	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\ConfidentSurf
2007-12-30 04:06 . 2007-12-30 04:12	<DIR>	d--------	C:\Program Files\ConfidentSurf
2007-12-30 04:06 . 2004-10-07 13:39	1,060,864	--a------	C:\WINDOWS\system32\mfc71.dll
2007-12-30 04:06 . 2004-10-07 13:39	499,712	--a------	C:\WINDOWS\system32\msvcp71.dll
2007-12-30 04:06 . 2007-02-13 08:09	388,126	--a------	C:\WINDOWS\system32\sqlite3.dll
2007-12-30 04:06 . 2004-10-07 13:39	348,160	--a------	C:\WINDOWS\system32\msvcr71.dll
2007-12-30 02:47 . 2007-12-30 02:47	1,606	--a------	C:\WINDOWS\system32\PerfStringBackup.TMP
2007-12-30 02:15 . 2007-12-30 02:15	137,728	--a------	C:\WINDOWS\system32\hfficiig.dll
2007-12-30 02:06 . 2007-12-30 02:06	<DIR>	d--------	C:\Program Files\Zango
2007-12-30 02:06 . 2007-12-30 02:45	<DIR>	d--------	C:\Documents and Settings\Me\Application Data\Zango
2007-12-30 02:06 . 2007-12-30 02:06	<DIR>	d--------	C:\Documents and Settings\Me\Application Data\WeatherDPA
2007-12-30 02:06 . 2007-12-30 02:14	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\ZangoSA
2007-12-30 02:06 . 2007-12-30 02:06	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\srchasst\srchasst.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\srchasst\mui\[u]0[/u]409\[u]0[/u]409.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\srchasst\chars\chars.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\Registration\Registration.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\UploadLB\Config\Config.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\UploadLB\Binaries\Binaries.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Remote Assistance.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Unsolicited\Unsolicited.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\Email.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Common.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\Css.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\Common.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\UpdateCtr\UpdateCtr.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\System.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\sysinfo\sysinfo.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\graphics.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\47x24pie\47x24pie.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\sysinfo\graphics\33x16pie\33x16pie.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\scripts\scripts.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Remote Assistance.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Server\Server.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Common.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Interaction\Client\Client.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Css\Css.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\Remote Assistance\Common\Common.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\rc\rc.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\panels\subpanels\subpanels.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\panels\panels.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\NetDiag\NetDiag.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\images\images.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\images\Expando\Expando.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\images\Centers\Centers.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\images\48x48\48x48.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\images\32x32\32x32.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\images\24x24\24x24.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\images\16x16\16x16.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\errors\errors.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\ErrMsg\ErrMsg.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\DVDUpgrd\DVDUpgrd.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\dialogs\dialogs.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\DFS\DFS.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\css\css.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\CompatCtr\CompatCtr.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\System\blurbs\blurbs.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\PackageStore\PackageStore.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\OfflineCache\Professional_32#0409\Professional_32#0409.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\OfflineCache\OfflineCache.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\Logs\Logs.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\Indices\Indices.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\Database\Database.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\Config\Config.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\Config\CheckPoint\CheckPoint.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\Config\Cache\Cache.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\pchealth\helpctr\binaries\binaries.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\Media\Media.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\Help\Tours\WindowsMediaPlayer\WindowsMediaPlayer.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Video\Video.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Scr\Scr.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\WMarks\WMarks.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Img.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\Btn.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Css\Css.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Cnt\Cnt.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Wav\Wav.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Audio.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\Help\Tours\mmTour\mmTour.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\Help\Tours\htmlTour\htmlTour.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\Help\Help.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\Cursors\Cursors.exe
2007-12-30 13:55	79,872	---h--w	C:\WINDOWS\AppPatch\AppPatch.exe
2007-12-30 01:22	---------	d-----w	C:\Program Files\MyBugFreePC
2007-12-30 01:17	---------	d-----w	C:\Program Files\Secure PC Solutions
2007-12-29 23:41	---------	d-----w	C:\Program Files\microsoft frontpage
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)


.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-30 23:10:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

C:\WINDOWS\system32\kalleny.config 41656 bytes
C:\WINDOWS\system32\kalleny2da2-577f.sys 131200 bytes executable
C:\WINDOWS\system32\kalleny2f24-3b2.sys 131200 bytes executable
C:\WINDOWS\system32\kalleny72a8-6f00.sys 131200 bytes executable
C:\WINDOWS\system32\kallenyfd4-560a.sys 131200 bytes executable

scan completed successfully 
hidden files: 5 

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\kalleny2da2-577f]
"ImagePath"="\??\C:\WINDOWS\system32\kalleny2da2-577f.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\kalleny2f24-3b2]
"ImagePath"="\??\C:\WINDOWS\system32\kalleny2f24-3b2.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\kalleny72a8-6f00]
"ImagePath"="\??\C:\WINDOWS\system32\kalleny72a8-6f00.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\kallenyfd4-560a]
"ImagePath"="\??\C:\WINDOWS\system32\kallenyfd4-560a.sys"
.
Completion time: 2007-12-30 23:10:52 - machine was rebooted