ComboFix 08-11-26.03 - Administrator 2008-11-26 12:15:56.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.83 [GMT -6:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFscript.txt,.txt
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Administrator\My Documents\My Documents.url
c:\documents and settings\Administrator\My Documents\My Music\My Music.url
c:\documents and settings\Administrator\My Documents\My Pictures\My Pictures.url
c:\documents and settings\Administrator\My Documents\My Videos\My Video.url
c:\program files\WAV
c:\program files\WAV\Uninstall.exe
c:\program files\WAV\WAV.cpl
c:\program files\WAV\WAV.exe
c:\program files\WebMediaViewer
c:\program files\WebMediaViewer\browseu.exe
c:\program files\WebMediaViewer\browseul.dll
c:\program files\WebMediaViewer\hpmom.exe
c:\program files\WebMediaViewer\hpmon.exe
c:\program files\WebMediaViewer\hpmun.dll
c:\program files\WebMediaViewer\hpmun.exe
c:\program files\WebMediaViewer\myd.ico
c:\program files\WebMediaViewer\mym.ico
c:\program files\WebMediaViewer\myp.ico
c:\program files\WebMediaViewer\myv.ico
c:\program files\WebMediaViewer\ot.ico
c:\program files\WebMediaViewer\qttask.exe
c:\program files\WebMediaViewer\qttaskm.exe
c:\program files\WebMediaViewer\qttasku.exe
c:\program files\WebMediaViewer\ts.ico
c:\windows\system32\wav.cpl
.
((((((((((((((((((((((((( Files Created from 2008-10-26 to 2008-11-26 )))))))))))))))))))))))))))))))
.
2008-11-26 00:42 . 2008-11-26 00:42 23,392 --a------ c:\windows\system32\nscompat.tlb
2008-11-26 00:42 . 2008-11-26 00:42 16,832 --a------ c:\windows\system32\amcompat.tlb
2008-11-26 00:32 . 2008-11-26 00:42
d-------- c:\windows\SxsCaPendDel
2008-11-25 19:50 . 2008-11-25 19:49 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-11-25 19:42 . 2008-11-25 19:49 410,976 --a------ c:\windows\system32\deploytk.dll
2008-11-25 16:48 . 2008-11-25 16:48 250 --a------ c:\windows\gmer.ini
2008-11-25 08:31 . 2008-11-25 08:31 d-------- c:\program files\Common Files\Download Manager
2008-11-25 08:19 . 2008-11-25 08:27 d-------- c:\program files\Perfect Uninstaller
2008-11-24 22:28 . 2007-09-02 20:56 1,686,016 --a------ c:\windows\system32\clinetsuitex6.ocx
2008-11-24 22:28 . 2004-03-09 16:45 662,288 --a------ c:\windows\system32\MSCOMCT2.OCX
2008-11-24 22:28 . 2004-06-14 14:56 427,864 --a------ c:\windows\system32\XceedZip.dll
2008-11-24 20:11 . 2008-11-25 22:32 54,156 --ah----- c:\windows\QTFont.qfn
2008-11-24 20:11 . 2008-11-24 20:11 1,409 --a------ c:\windows\QTFont.for
2008-11-24 11:43 . 2008-11-24 16:33 d-------- c:\program files\Spybot - Search & Destroy
2008-11-24 11:43 . 2008-11-24 19:12 d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-24 11:25 . 2008-11-24 11:25 0 --a------ c:\windows\nsreg.dat
2008-11-24 10:27 . 2008-11-24 10:27 d-------- c:\temp\google
2008-11-24 09:41 . 2008-11-24 11:45 d-------- c:\documents and settings\All Users\Application Data\SITEguard
2008-11-24 09:40 . 2008-11-24 09:40 d-------- c:\program files\Common Files\iS3
2008-11-24 09:40 . 2008-11-24 12:08 d-------- c:\documents and settings\All Users\Application Data\STOPzilla!
2008-11-24 09:19 . 2008-11-25 14:12 d-a------ c:\documents and settings\All Users\Application Data\TEMP
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-26 06:43 --------- d-----w c:\program files\Common Files\Adobe
2008-11-26 06:37 --------- d-----w c:\program files\Windows Live
2008-11-26 06:36 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-11-26 06:33 --------- d-----w c:\program files\Google
2008-11-26 06:25 --------- d-----w c:\program files\Windows Media Connect 2
2008-11-26 01:54 --------- d-----w c:\program files\Java
2008-11-25 23:50 105,472 ----a-w c:\windows\system32\ynwnwlj.dll
2008-11-25 14:38 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-11-24 18:11 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-11-24 17:54 --------- d-----w c:\documents and settings\All Users\Application Data\PCPitstop
2008-10-16 20:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 20:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 20:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 20:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 20:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 20:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 20:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 20:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 20:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 20:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-04 16:37 --------- d-----w c:\program files\JumpStart
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-27 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-12 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="-" [X]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-20 118784]
"Lexmark X74-X75"="c:\program files\Lexmark X74-X75\lxbbbmgr.exe" [2002-10-14 57344]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Mobile User VPN.lnk - c:\program files\WatchGuard\Mobile User VPN\SafeCfg.exe [2006-06-08 65588]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\WatchGuard\\Mobile User VPN\\IreIKE.exe"=
"c:\program files\WatchGuard\Mobile User VPN\ViewLog.exe"= c:\program files\WatchGuard\Mobile User VPN\ViewLog.exe:127.0.0.1/255.255.255.255:Enabled:ViewLog
"c:\program files\WatchGuard\Mobile User VPN\CmonApp.exe"= c:\program files\WatchGuard\Mobile User VPN\CmonApp.exe:127.0.0.1/255.255.255.255:Enabled:CMonApp
"c:\program files\WatchGuard\Mobile User VPN\vpn.exe"= c:\program files\WatchGuard\Mobile User VPN\vpn.exe:127.0.0.1/255.255.255.255:Enabled:VPN Connection Manager
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"38750:TCP"= 38750:TCP:@xpsp2res.dll
"2552:TCP"= 2552:TCP:@xpsp2res.dll
"80:TCP"= 80:TCP:@xpsp2res.dll,-22009
"36875:TCP"= 36875:TCP:@xpsp2res.dll
"49480:TCP"= 49480:TCP:@xpsp2res.dll
"7529:TCP"= 7529:TCP:@xpsp2res.dll
"5908:TCP"= 5908:TCP:@xpsp2res.dll
"60232:TCP"= 60232:TCP:@xpsp2res.dll,-22009
"58952:TCP"= 58952:TCP:@xpsp2res.dll,-22009
"60766:TCP"= 60766:TCP:@xpsp2res.dll,-22009
"33272:TCP"= 33272:TCP:@xpsp2res.dll,-22009
"32080:TCP"= 32080:TCP:@xpsp2res.dll,-22009
"36756:TCP"= 36756:TCP:@xpsp2res.dll,-22009
"62486:TCP"= 62486:TCP:@xpsp2res.dll,-22009
"2571:TCP"= 2571:TCP:@xpsp2res.dll,-22009
"50044:TCP"= 50044:TCP:@xpsp2res.dll,-22009
"63081:TCP"= 63081:TCP:@xpsp2res.dll,-22009
"49686:TCP"= 49686:TCP:@xpsp2res.dll,-22009
R2 Crypto;Crypto;c:\windows\system32\drivers\Crypto.sys [2006-06-08 521786]
R2 IPSECDRV;SafeNet IPSec Plugin;\??\c:\windows\system32\Drivers\IPSECDRV.sys [2006-06-08 119864]
R3 DniVap;SafeNet WAN Miniport (VA);c:\windows\system32\DRIVERS\vap.sys [2006-06-08 36188]
.
- - - - ORPHANS REMOVED - - - -
Toolbar-SITEguard - (no file)
HKCU-Run-Uniblue Registry Booster2 - c:\program files\Uniblue\RegistryBooster2\RegistryBooster.exe
HKLM-Run-PC Pitstop Optimize Reminder - c:\program files\PCPitstop\Optimize2\Reminder.exe
HKLM-Run-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
HKLM-Run-ANTIVIRUS - c:\program files\WAV\wav.exe
HKLM-Explorer_Run-QuickTime Task - c:\program files\WebMediaViewer\qttask.exe
HKLM-Explorer_Run-VMware hptray - c:\program files\WebMediaViewer\hpmon.exe
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-26 12:17:21
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-11-26 12:18:26
ComboFix-quarantined-files.txt 2008-11-26 18:18:01
ComboFix2.txt 2008-11-26 00:50:40
Pre-Run: 11,264,774,144 bytes free
Post-Run: 11,288,416,256 bytes free
156 --- E O F --- 2008-09-20 14:45:28