ComboFix 11-01-28.01 - mindy 01/28/2011 13:02:48.5.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.383.117 [GMT -8:00]
Running from: c:\documents and settings\mindy\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\mindy\Desktop\CFScript.txt
AV: Avira AntiVir PersonalEdition Classic *Enabled/Outdated* {806ED0B3-FFA4-00EB-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Outdated* {806ED0B3-FFA4-00FC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {00000000-0000-0000-0000-000000000000}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {806ED0B3-FFA4-00DA-0D24-347CA8A3377C}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
"c:\program files\Common Files\ifuh.dll"
"c:\program files\Common Files\ohixyz.vbs"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Common Files\ifuh.dll
c:\program files\Common Files\ohixyz.vbs
.
((((((((((((((((((((((((( Files Created from 2010-12-28 to 2011-01-28 )))))))))))))))))))))))))))))))
.
2011-01-24 18:08 . 2008-04-14 14:00 4224 -c--a-w- c:\windows\system32\beep.sys
2011-01-24 18:05 . 2011-01-24 18:05 85613654 -c--a-w- C:\registrybackup.reg
2011-01-22 14:19 . 2004-08-04 07:56 55808 -c--a-w- c:\windows\system32\eventlog.dll
2011-01-22 14:19 . 2004-08-04 07:56 55808 -c--a-w- c:\windows\system32\dllcache\eventlog.dll
2011-01-19 21:20 . 2011-01-19 21:20 -------- dc----w- c:\documents and settings\All Users\Application Data\Sunbelt
2011-01-19 19:09 . 2011-01-19 19:09 -------- dc----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2011-01-19 19:08 . 2011-01-20 02:15 -------- dc----w- c:\documents and settings\All Users\Application Data\Alwil Software
2011-01-19 19:08 . 2011-01-19 19:08 -------- dc----w- c:\program files\Alwil Software
2011-01-19 18:27 . 2010-04-29 23:39 38224 -c--a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-19 18:27 . 2011-01-19 18:27 -------- dc----w- c:\program files\Malwarebytes' Anti-Malware
2011-01-19 18:27 . 2010-04-29 23:39 20952 -c--a-w- c:\windows\system32\drivers\mbam.sys
2011-01-19 18:17 . 2011-01-19 18:17 -------- dc----w- c:\program files\Trend Micro
2011-01-19 06:19 . 2011-01-19 07:14 -------- dc----w- c:\documents and settings\mindy\Application Data\U3
2011-01-19 06:11 . 2011-01-19 06:11 -------- dc----w- c:\program files\Belkin
2011-01-19 06:10 . 2011-01-19 06:10 -------- dc----w- c:\windows\{113016FE-E013-4FAF-85FB-8649DEED76B2}
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
------- Sigcheck -------
[7] 2008-04-14 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\beep.sys
c:\windows\System32\drivers\beep.sys ... is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PhotoShow Deluxe Media Manager"="c:\progra~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe" [2005-01-22 163840]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-03 68856]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTHelper"="CTHELPER.EXE" [2003-10-06 24576]
"zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2002-11-23 631362]
"Logitech Utility"="Logi_MwX.Exe" [2002-11-08 19968]
"mmtask"="c:\program files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2006-01-17 53248]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-10-23 185896]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-26 282624]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
c:\documents and settings\mindy\Start Menu\Programs\Startup\
RDP2009.lnk - c:\program files\Angle Interactive\RDP2009\RDP2009.exe [2009-6-29 1193408]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-11-8 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
hp psc 1000 series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-4-6 147456]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
LUMIX Simple Viewer.lnk - c:\program files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2007-1-27 57344]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-3-21 65588]
Wireless-B PCI Adapter Utility.lnk - c:\program files\Linksys\WMP11 Config Utility\WMP11Cfg.exe [2004-11-8 4638720]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Ahead\\Nero ShowTime\\ShowTime.exe"=
"c:\\My Downloads\\WoW-BurningCrusade-enUS-Installer-downloader.exe"=
"c:\\Program Files\\QuickTime\\qttask.exe"=
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/19/2011 11:09 AM 136176]
S3 RTL8192su;%RTL8192su.DeviceDesc.DispName%;c:\windows\system32\drivers\RTL8192su.sys [1/6/2010 5:21 PM 594048]
.
Contents of the 'Scheduled Tasks' folder
2004-12-17 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2003-03-31 07:56]
2007-03-04 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1200 series5E771253C1676EBED677BF361FDFC537825E15B8100065084.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 08:52]
2011-01-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-19 19:09]
2011-01-28 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-30 05:18]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-28 13:10
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(864)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2011-01-28 13:13:21
ComboFix-quarantined-files.txt 2011-01-28 21:13
ComboFix2.txt 2011-01-23 00:48
ComboFix3.txt 2011-01-22 14:22
ComboFix4.txt 2011-01-21 17:24
ComboFix5.txt 2011-01-28 20:49
Pre-Run: 13,933,899,776 bytes free
Post-Run: 13,931,413,504 bytes free
- - End Of File - - 014A7810316DF2E6A7E573AB6FB7A719