Hello there, here is the log-
ComboFix 10-07-15.01 - Donnie Thibodeaux 07/15/2010 19:57:37.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1535.910 [GMT -5:00]
Running from: c:\documents and settings\Donnie Thibodeaux\Desktop\Tools\Combofix\Combo-Fix.exe
Command switches used :: c:\documents and settings\Donnie Thibodeaux\Desktop\CFscript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
.
((((((((((((((((((((((((( Files Created from 2010-06-16 to 2010-07-16 )))))))))))))))))))))))))))))))
.
2010-07-16 00:32 . 2010-07-16 00:32 -------- d-----w- c:\program files\DIFX
2010-07-16 00:32 . 2010-07-16 00:33 -------- d-----w- c:\winnt\LastGood
2010-07-16 00:32 . 2009-11-11 21:59 197952 ----a-w- c:\winnt\system32\FTLang.dll
2010-07-16 00:32 . 2009-11-11 21:59 57800 ----a-w- c:\winnt\system32\drivers\ftdibus.sys
2010-07-16 00:32 . 2009-11-11 21:59 206144 ----a-w- c:\winnt\system32\ftd2xx.dll
2010-07-16 00:32 . 2009-11-11 21:59 120136 ----a-w- c:\winnt\system32\ftbusui.dll
2010-07-16 00:32 . 2010-07-16 00:37 -------- d-----w- c:\program files\Superchips Easy Update
2010-07-16 00:31 . 2010-07-16 00:31 -------- d-----w- c:\documents and settings\Donnie Thibodeaux\Local Settings\Application Data\Downloaded Installations
2010-07-08 03:55 . 2010-07-08 03:55 -------- d-----w- C:\_OTL
2010-07-01 10:19 . 2010-07-01 10:19 -------- d-----w- c:\program files\SDHelper (Spybot - Search & Destroy)
2010-07-01 10:19 . 2010-07-01 10:19 -------- d-----w- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2010-07-01 10:19 . 2010-07-01 10:19 -------- d-----w- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2010-07-01 10:19 . 2010-07-01 10:19 -------- d-----w- c:\program files\TeaTimer (Spybot - Search & Destroy)
2010-06-30 07:18 . 2010-06-30 07:18 0 ----a-w- c:\winnt\nsreg.dat
2010-06-30 07:18 . 2010-06-30 07:18 -------- d-----w- c:\documents and settings\Donnie Thibodeaux\Local Settings\Application Data\Mozilla
2010-06-30 04:54 . 2010-06-30 04:54 -------- d-sh--w- c:\winnt\system32\config\systemprofile\IETldCache
2010-06-30 04:53 . 2010-06-30 04:53 -------- d-----w- c:\documents and settings\Donnie Thibodeaux\Local Settings\Application Data\Threat Expert
2010-06-30 04:29 . 2010-06-30 07:02 -------- d-----w- c:\program files\Spyware Doctor
2010-06-30 04:16 . 2010-06-30 04:16 -------- d-----w- c:\program files\Trend Micro
2010-06-28 11:19 . 2010-06-28 11:19 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-06-25 09:07 . 2010-06-25 09:07 664 ----a-w- c:\winnt\system32\d3d9caps.dat
2010-06-25 09:07 . 2010-06-25 09:07 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2010-06-24 04:07 . 2010-06-24 11:18 -------- d-----w- c:\documents and settings\Donnie Thibodeaux\Local Settings\Application Data\mounetcjh
2010-06-24 04:07 . 2010-06-24 04:07 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-06-21 18:59 . 2010-06-21 18:59 -------- d-----w- c:\program files\iPod
2010-06-21 18:59 . 2010-06-21 19:01 -------- d-----w- c:\program files\iTunes
2010-06-21 18:54 . 2010-06-21 18:54 -------- d-----w- c:\program files\Bonjour
2010-06-21 18:49 . 2010-06-21 18:49 72504 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.0.61\SetupAdmin.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-16 00:52 . 2006-03-15 23:23 -------- d-----w- c:\program files\Symantec AntiVirus
2010-07-02 19:56 . 2006-01-20 22:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-07-01 20:58 . 2006-01-20 22:07 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-06-30 06:59 . 2010-03-13 03:06 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-06-21 18:59 . 2009-12-28 23:27 -------- d-----w- c:\program files\Common Files\Apple
2010-06-20 21:57 . 2007-11-26 19:13 -------- d-----w- c:\program files\Coupons
2010-06-05 01:38 . 2006-03-22 00:47 -------- d-----w- c:\program files\Setup Files
2010-06-05 01:15 . 2006-03-22 00:45 -------- d-----w- c:\program files\MSI
2010-06-05 00:30 . 2010-06-05 00:30 -------- d-----w- c:\program files\ATI Technologies
2010-06-05 00:30 . 2006-01-20 18:27 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-05-28 18:32 . 2006-04-23 21:31 -------- d-----w- c:\program files\Google
2010-05-24 14:11 . 2010-03-13 21:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-18 21:35 . 2010-05-18 21:35 91424 ----a-w- c:\winnt\system32\dnssd.dll
2010-05-18 21:35 . 2010-05-18 21:35 107808 ----a-w- c:\winnt\system32\dns-sd.exe
2010-05-06 10:41 . 2001-08-23 12:00 916480 ----a-w- c:\winnt\system32\wininet.dll
2010-05-02 05:56 . 2001-08-23 12:00 1850880 ----a-w- c:\winnt\system32\win32k.sys
2010-04-29 20:39 . 2010-03-13 21:15 38224 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2010-04-29 20:39 . 2010-03-13 21:15 20952 ----a-w- c:\winnt\system32\drivers\mbam.sys
2010-04-20 05:51 . 2001-08-23 12:00 285696 ----a-w- c:\winnt\system32\atmfd.dll
2010-04-20 01:47 . 2009-12-28 23:28 3062048 ----a-w- c:\winnt\system32\usbaaplrc.dll
2010-04-20 01:47 . 2009-12-28 23:28 41984 ----a-w- c:\winnt\system32\drivers\usbaapl.sys
2006-01-20 16:57 . 2006-01-20 16:57 21952 -c-h--w- c:\program files\folder.htt
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-06-02 48752]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2005-06-24 85696]
"NeroFilterCheck"="c:\winnt\system32\NeroCheck.exe" [2001-07-09 155648]
"MsmqIntCert"="mqrt.dll" [2009-06-25 177152]
"Synchronization Manager"="mobsync.exe" [2004-08-04 143360]
"NeroCheck"="c:\winnt\System32\NeroCheck.exe" [2001-07-09 155648]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="c:\program files\Internet Explorer\Connection Wizard\icwconn1.exe" [2004-08-04 214528]
"tscuninstall"="c:\winnt\system32\tscupgrd.exe" [2004-08-04 44544]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
AudioDeck.lnk - c:\program files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe [2008-6-25 581632]
HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AudioDeck.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AudioDeck.lnk
backup=c:\winnt\pss\AudioDeck.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\winnt\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 21:24 54840 -c--a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool]
2006-12-28 21:09 4579328 -c--a-w- c:\program files\VIA\RAID\raid_tool.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2008-02-22 09:25 144784 -c--a-w- c:\program files\Java\jre1.6.0_05\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"LightScribeService"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\WINNT\\system32\\mqsvc.exe"=
"c:\\WINNT\\system32\\spoolsv.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\MSI\\i-Speeder\\i-Speeder.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R3 EraserUtilDrv11010;EraserUtilDrv11010;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11010.sys [7/15/2010 7:22 PM 102448]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [5/28/2010 1:31 PM 136176]
S3 959b9316-5b8b-4312-9d5d-fe5682ba0673;959b9316-5b8b-4312-9d5d-fe5682ba0673;\??\d:\cds300\cds300.dll --> d:\cds300\cds300.dll [?]
S3 FLASHSYS;FLASHSYS;c:\program files\MSI\Live Update 4\LU4\FlashSys.sys [6/4/2010 8:23 PM 9216]
S3 openhci;Microsoft USB Open Host Controller Driver;c:\winnt\system32\drivers\openhci.sys [12/7/1999 7:00 AM 24784]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [6/23/2005 8:27 PM 124608]
S3 usbhub20;USB 2.0 Root Hub Support;c:\winnt\system32\drivers\usbhub20.sys [3/15/2006 5:27 PM 69472]
S3 viafilter;VIA USB Filter;c:\winnt\system32\drivers\viausb.sys [3/15/2006 2:11 AM 9038]
S3 Vsp;Vsp;c:\winnt\system32\drivers\vsp.sys [6/25/2008 10:07 PM 3351]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
Contents of the 'Scheduled Tasks' folder
2010-07-12 c:\winnt\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
2010-07-15 c:\winnt\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-28 18:30]
2010-07-16 c:\winnt\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-28 18:30]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
uInternet Settings,ProxyServer = http=127.0.0.1:5577
uInternet Settings,ProxyOverride =
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: {{20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - {20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - c:\winnt\System32\mscoree.DLL
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-15 20:03
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(484)
c:\winnt\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(2436)
c:\winnt\system32\WININET.dll
c:\winnt\system32\ieframe.dll
c:\winnt\system32\webcheck.dll
c:\winnt\system32\WPDShServiceObj.dll
c:\winnt\system32\PortableDeviceTypes.dll
c:\winnt\system32\PortableDeviceApi.dll
.
Completion time: 2010-07-15 20:06:35
ComboFix-quarantined-files.txt 2010-07-16 01:06
ComboFix2.txt 2010-07-15 02:01
Pre-Run: 3,862,712,320 bytes free
Post-Run: 3,845,373,952 bytes free
- - End Of File - - 091393A01737E03B94430407C8918CDB
ComboFix 10-07-15.01 - Donnie Thibodeaux 07/15/2010 19:57:37.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1535.910 [GMT -5:00]
Running from: c:\documents and settings\Donnie Thibodeaux\Desktop\Tools\Combofix\Combo-Fix.exe
Command switches used :: c:\documents and settings\Donnie Thibodeaux\Desktop\CFscript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
.
((((((((((((((((((((((((( Files Created from 2010-06-16 to 2010-07-16 )))))))))))))))))))))))))))))))
.
2010-07-16 00:32 . 2010-07-16 00:32 -------- d-----w- c:\program files\DIFX
2010-07-16 00:32 . 2010-07-16 00:33 -------- d-----w- c:\winnt\LastGood
2010-07-16 00:32 . 2009-11-11 21:59 197952 ----a-w- c:\winnt\system32\FTLang.dll
2010-07-16 00:32 . 2009-11-11 21:59 57800 ----a-w- c:\winnt\system32\drivers\ftdibus.sys
2010-07-16 00:32 . 2009-11-11 21:59 206144 ----a-w- c:\winnt\system32\ftd2xx.dll
2010-07-16 00:32 . 2009-11-11 21:59 120136 ----a-w- c:\winnt\system32\ftbusui.dll
2010-07-16 00:32 . 2010-07-16 00:37 -------- d-----w- c:\program files\Superchips Easy Update
2010-07-16 00:31 . 2010-07-16 00:31 -------- d-----w- c:\documents and settings\Donnie Thibodeaux\Local Settings\Application Data\Downloaded Installations
2010-07-08 03:55 . 2010-07-08 03:55 -------- d-----w- C:\_OTL
2010-07-01 10:19 . 2010-07-01 10:19 -------- d-----w- c:\program files\SDHelper (Spybot - Search & Destroy)
2010-07-01 10:19 . 2010-07-01 10:19 -------- d-----w- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2010-07-01 10:19 . 2010-07-01 10:19 -------- d-----w- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2010-07-01 10:19 . 2010-07-01 10:19 -------- d-----w- c:\program files\TeaTimer (Spybot - Search & Destroy)
2010-06-30 07:18 . 2010-06-30 07:18 0 ----a-w- c:\winnt\nsreg.dat
2010-06-30 07:18 . 2010-06-30 07:18 -------- d-----w- c:\documents and settings\Donnie Thibodeaux\Local Settings\Application Data\Mozilla
2010-06-30 04:54 . 2010-06-30 04:54 -------- d-sh--w- c:\winnt\system32\config\systemprofile\IETldCache
2010-06-30 04:53 . 2010-06-30 04:53 -------- d-----w- c:\documents and settings\Donnie Thibodeaux\Local Settings\Application Data\Threat Expert
2010-06-30 04:29 . 2010-06-30 07:02 -------- d-----w- c:\program files\Spyware Doctor
2010-06-30 04:16 . 2010-06-30 04:16 -------- d-----w- c:\program files\Trend Micro
2010-06-28 11:19 . 2010-06-28 11:19 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-06-25 09:07 . 2010-06-25 09:07 664 ----a-w- c:\winnt\system32\d3d9caps.dat
2010-06-25 09:07 . 2010-06-25 09:07 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2010-06-24 04:07 . 2010-06-24 11:18 -------- d-----w- c:\documents and settings\Donnie Thibodeaux\Local Settings\Application Data\mounetcjh
2010-06-24 04:07 . 2010-06-24 04:07 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-06-21 18:59 . 2010-06-21 18:59 -------- d-----w- c:\program files\iPod
2010-06-21 18:59 . 2010-06-21 19:01 -------- d-----w- c:\program files\iTunes
2010-06-21 18:54 . 2010-06-21 18:54 -------- d-----w- c:\program files\Bonjour
2010-06-21 18:49 . 2010-06-21 18:49 72504 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.0.61\SetupAdmin.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-16 00:52 . 2006-03-15 23:23 -------- d-----w- c:\program files\Symantec AntiVirus
2010-07-02 19:56 . 2006-01-20 22:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-07-01 20:58 . 2006-01-20 22:07 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-06-30 06:59 . 2010-03-13 03:06 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-06-21 18:59 . 2009-12-28 23:27 -------- d-----w- c:\program files\Common Files\Apple
2010-06-20 21:57 . 2007-11-26 19:13 -------- d-----w- c:\program files\Coupons
2010-06-05 01:38 . 2006-03-22 00:47 -------- d-----w- c:\program files\Setup Files
2010-06-05 01:15 . 2006-03-22 00:45 -------- d-----w- c:\program files\MSI
2010-06-05 00:30 . 2010-06-05 00:30 -------- d-----w- c:\program files\ATI Technologies
2010-06-05 00:30 . 2006-01-20 18:27 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-05-28 18:32 . 2006-04-23 21:31 -------- d-----w- c:\program files\Google
2010-05-24 14:11 . 2010-03-13 21:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-18 21:35 . 2010-05-18 21:35 91424 ----a-w- c:\winnt\system32\dnssd.dll
2010-05-18 21:35 . 2010-05-18 21:35 107808 ----a-w- c:\winnt\system32\dns-sd.exe
2010-05-06 10:41 . 2001-08-23 12:00 916480 ----a-w- c:\winnt\system32\wininet.dll
2010-05-02 05:56 . 2001-08-23 12:00 1850880 ----a-w- c:\winnt\system32\win32k.sys
2010-04-29 20:39 . 2010-03-13 21:15 38224 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2010-04-29 20:39 . 2010-03-13 21:15 20952 ----a-w- c:\winnt\system32\drivers\mbam.sys
2010-04-20 05:51 . 2001-08-23 12:00 285696 ----a-w- c:\winnt\system32\atmfd.dll
2010-04-20 01:47 . 2009-12-28 23:28 3062048 ----a-w- c:\winnt\system32\usbaaplrc.dll
2010-04-20 01:47 . 2009-12-28 23:28 41984 ----a-w- c:\winnt\system32\drivers\usbaapl.sys
2006-01-20 16:57 . 2006-01-20 16:57 21952 -c-h--w- c:\program files\folder.htt
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-06-02 48752]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2005-06-24 85696]
"NeroFilterCheck"="c:\winnt\system32\NeroCheck.exe" [2001-07-09 155648]
"MsmqIntCert"="mqrt.dll" [2009-06-25 177152]
"Synchronization Manager"="mobsync.exe" [2004-08-04 143360]
"NeroCheck"="c:\winnt\System32\NeroCheck.exe" [2001-07-09 155648]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="c:\program files\Internet Explorer\Connection Wizard\icwconn1.exe" [2004-08-04 214528]
"tscuninstall"="c:\winnt\system32\tscupgrd.exe" [2004-08-04 44544]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
AudioDeck.lnk - c:\program files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe [2008-6-25 581632]
HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AudioDeck.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AudioDeck.lnk
backup=c:\winnt\pss\AudioDeck.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\winnt\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 21:24 54840 -c--a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool]
2006-12-28 21:09 4579328 -c--a-w- c:\program files\VIA\RAID\raid_tool.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2008-02-22 09:25 144784 -c--a-w- c:\program files\Java\jre1.6.0_05\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"LightScribeService"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\WINNT\\system32\\mqsvc.exe"=
"c:\\WINNT\\system32\\spoolsv.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\MSI\\i-Speeder\\i-Speeder.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R3 EraserUtilDrv11010;EraserUtilDrv11010;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11010.sys [7/15/2010 7:22 PM 102448]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [5/28/2010 1:31 PM 136176]
S3 959b9316-5b8b-4312-9d5d-fe5682ba0673;959b9316-5b8b-4312-9d5d-fe5682ba0673;\??\d:\cds300\cds300.dll --> d:\cds300\cds300.dll [?]
S3 FLASHSYS;FLASHSYS;c:\program files\MSI\Live Update 4\LU4\FlashSys.sys [6/4/2010 8:23 PM 9216]
S3 openhci;Microsoft USB Open Host Controller Driver;c:\winnt\system32\drivers\openhci.sys [12/7/1999 7:00 AM 24784]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [6/23/2005 8:27 PM 124608]
S3 usbhub20;USB 2.0 Root Hub Support;c:\winnt\system32\drivers\usbhub20.sys [3/15/2006 5:27 PM 69472]
S3 viafilter;VIA USB Filter;c:\winnt\system32\drivers\viausb.sys [3/15/2006 2:11 AM 9038]
S3 Vsp;Vsp;c:\winnt\system32\drivers\vsp.sys [6/25/2008 10:07 PM 3351]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
Contents of the 'Scheduled Tasks' folder
2010-07-12 c:\winnt\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
2010-07-15 c:\winnt\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-28 18:30]
2010-07-16 c:\winnt\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-28 18:30]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
uInternet Settings,ProxyServer = http=127.0.0.1:5577
uInternet Settings,ProxyOverride =
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: {{20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - {20CCCFEC-D26F-4ffe-996B-388B39C8CCCA} - c:\winnt\System32\mscoree.DLL
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-15 20:03
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(484)
c:\winnt\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(2436)
c:\winnt\system32\WININET.dll
c:\winnt\system32\ieframe.dll
c:\winnt\system32\webcheck.dll
c:\winnt\system32\WPDShServiceObj.dll
c:\winnt\system32\PortableDeviceTypes.dll
c:\winnt\system32\PortableDeviceApi.dll
.
Completion time: 2010-07-15 20:06:35
ComboFix-quarantined-files.txt 2010-07-16 01:06
ComboFix2.txt 2010-07-15 02:01
Pre-Run: 3,862,712,320 bytes free
Post-Run: 3,845,373,952 bytes free
- - End Of File - - 091393A01737E03B94430407C8918CDB