ComboFix 09-09-13.04 - PatrickC 09/13/2009 18:27.3.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1022.538 [GMT -7:00]
Running from: c:\documents and settings\PatrickC\Desktop\Combo-Fix.exe
.
((((((((((((((((((((((((( Files Created from 2009-08-14 to 2009-09-14 )))))))))))))))))))))))))))))))
.
2009-09-11 21:16 . 2009-09-11 21:16 -------- d-----w- c:\program files\Trend Micro
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-14 01:27 . 2008-10-28 09:17 -------- d-----w- c:\documents and settings\PatrickC\Application Data\.purple
2009-09-13 10:20 . 2009-03-02 09:03 -------- d-----w- c:\program files\Warcraft III
2009-09-04 16:18 . 2008-10-28 10:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-04 08:47 . 2008-10-28 10:52 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-26 01:16 . 2009-03-05 05:45 77727 -c--a-w- c:\windows\War3Unin.dat
2009-08-24 04:21 . 2008-12-23 10:12 -------- d-----w- c:\program files\Full Tilt Poker
2009-08-23 23:32 . 2008-10-28 10:07 -------- d-----w- c:\program files\Steam
2009-08-19 07:23 . 2009-08-01 18:47 -------- d-----w- c:\program files\Warkeys
2009-08-15 16:33 . 2009-07-31 23:11 -------- d-----w- c:\program files\DotA Gaming Network
2009-08-13 23:49 . 2009-08-13 23:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-06 07:52 . 2008-10-28 10:15 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-06 00:02 . 2009-08-05 23:08 -------- d-----w- c:\documents and settings\PatrickC\Application Data\dvdcss
2009-08-05 17:31 . 2009-06-24 17:16 -------- d-----w- c:\program files\Lavasoft
2009-08-03 20:36 . 2009-08-13 23:49 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 20:36 . 2009-08-13 23:49 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-29 17:31 . 2009-07-29 17:31 -------- d-----w- c:\documents and settings\PatrickC\Application Data\AVG8
2009-07-29 17:29 . 2009-07-29 17:29 -------- d-----w- c:\documents and settings\PatrickC\Application Data\IObit
2009-07-29 17:28 . 2009-07-29 17:28 -------- d-----w- c:\program files\IObit
2009-07-26 08:01 . 2009-01-28 22:54 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2009-07-21 05:20 . 2008-10-29 06:53 -------- d-----w- c:\documents and settings\PatrickC\Application Data\gtk-2.0
2006-11-20 08:48 . 2006-11-20 08:48 161768 --sha-r- c:\windows\system32\qsxutg.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-02 289576]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
c:\documents and settings\PatrickC\Start Menu\Programs\Startup\
Warkeys Update.lnk - c:\program files\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe [2009-5-3 244736]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"Steam"="c:\program files\Steam\Steam.exe" -silent
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"nwiz"=nwiz.exe /install
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Steam\\steamapps\\xchung\\counter-strike\\hl.exe"=
"c:\\Program Files\\Pidgin\\pidgin.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\Steam\\steamapps\\xchung\\team fortress 2\\hl2.exe"=
"c:\\Program Files\\Warcraft III\\war3.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\unreal tournament 3\\Binaries\\UT3.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4618:TCP"= 4618:TCP:gjdeaxb
R3 ngrpci;NETGEAR FA310TX Fast Ethernet Adapter Driver;c:\windows\system32\drivers\ngrpci.sys [6/24/2009 10:41 AM 32840]
S2 dqtvvvov;Update Time;c:\windows\system32\svchost.exe -k netsvcs [8/3/2004 4:56 PM 14336]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6/24/2009 10:41 AM 32512]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
dqtvvvov
.
Contents of the 'Scheduled Tasks' folder
2009-09-07 c:\windows\Tasks\SmartDefrag.job
- c:\program files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe [2009-07-29 16:22]
.
.
------- Supplementary Scan -------
.
uStart Page =
hxxp://google.com/IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\PatrickC\Application Data\Mozilla\Firefox\Profiles\rpty7eqc.default\
---- FIREFOX POLICIES ----
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-09-13 18:36
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dqtvvvov]
"ServiceDll"="c:\windows\system32\qsxutg.dll"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(2772)
c:\windows\system32\msi.dll
.
Completion time: 2009-09-14 18:39
ComboFix-quarantined-files.txt 2009-09-14 01:38
ComboFix2.txt 2009-08-06 18:54
ComboFix3.txt 2009-08-06 15:54
Pre-Run: 107,333,828,608 bytes free
Post-Run: 107,305,697,280 bytes free
107