This is my ComboFix log
ComboFix 08-01-18.4 - Compaq_Administrator 2008-01-18 23:36:17.1 -
NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.189
[GMT 8:00]
Running from: C:\Documents and
Settings\Compaq_Administrator\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions
)))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\_000007_.tmp.dll
C:\WINDOWS\system32\_000010_.tmp.dll
C:\WINDOWS\system32\_000011_.tmp.dll
C:\WINDOWS\system32\_000012_.tmp.dll
.
((((((((((((((((((((((((( Files Created from 2007-12-18 to
2008-01-18 )))))))))))))))))))))))))))))))
.
2008-01-18 23:35 . 2000-08-31 08:00 51,200 --a------
C:\WINDOWS\NirCmd.exe
2008-01-18 20:14 . 2007-01-18 20:00 3,968 --a------
C:\WINDOWS\system32\drivers\AvgArCln.sys
2008-01-17 23:00 . 2008-01-17 23:00 d--------
C:\WINDOWS\system32\Kaspersky Lab
2008-01-17 23:00 . 2008-01-17 23:00 d-------- C:\Documents and
Settings\All Users\Application Data\Kaspersky Lab
2008-01-17 22:23 . 2008-01-17 22:23 d-------- C:\Program
Files\Trend Micro
2008-01-17 00:00 . 2008-01-17 00:00 d-------- C:\Program
Files\MSXML 6.0
2008-01-15 21:16 . 2008-01-15 21:16 d-------- C:\Program
Files\MSDN
2008-01-15 21:11 . 2008-01-15 21:14 d-------- C:\Program
Files\Microsoft SQL Server
2008-01-15 21:10 . 2008-01-15 21:10 d-------- C:\Program
Files\Microsoft SQL Server 2005 Mobile Edition
2008-01-15 21:10 . 2008-01-15 21:10 d-------- C:\Program
Files\Microsoft Device Emulator
2008-01-15 21:04 . 2008-01-15 21:04 d-------- C:\Program
Files\MSBuild
2008-01-15 20:58 . 2008-01-15 20:58 d--------
C:\WINDOWS\Symbols
2008-01-15 20:58 . 2008-01-15 21:12 d-------- C:\Program
Files\Microsoft.NET
2008-01-15 20:58 . 2008-01-15 21:03 d-------- C:\Program Files\HTML
Help Workshop
2008-01-15 20:58 . 2008-01-15 21:03 d-------- C:\Program
Files\Common Files\Merge Modules
2008-01-15 20:58 . 2008-01-15 21:00 d-------- C:\Program
Files\Common Files\Business Objects
2008-01-15 20:58 . 2008-01-15 20:58 d-------- C:\Program Files\CE
Remote Tools
2008-01-15 20:58 . 2008-01-15 20:59 d-------- C:\Documents and
Settings\All Users\Application Data\PreEmptive Solutions
2008-01-15 20:56 . 2008-01-15 21:04 d-------- C:\Program
Files\Microsoft Visual Studio 8
2008-01-15 20:56 . 2008-01-15 21:35 d-------- C:\Documents and
Settings\All Users\Application Data\Microsoft Help
2008-01-11 18:37 . 2008-01-11 19:59 d-------- C:\Documents and
Settings\Compaq_Administrator\Application Data\Colasoft Packet
Builder
2008-01-11 18:21 . 2008-01-11 18:21 d-------- C:\Program
Files\Common Files\Colasoft Shared
2008-01-11 18:21 . 2008-01-11 18:21 d-------- C:\Program
Files\Colasoft Packet Builder 1.0
2008-01-11 14:41 . 2008-01-11 14:41 d-------- C:\Program
Files\WinPcap
2008-01-11 14:38 . 2008-01-11 14:38 d-------- C:\Snort
2008-01-11 12:36 . 2008-01-11 12:36 d-------- C:\Program
Files\Electronic Arts
2008-01-11 12:36 . 1999-04-02 16:37 33,792 -ra------
C:\WINDOWS\NPSExec.exe
2008-01-11 12:35 . 2008-01-16 16:29 d-------- C:\Program
Files\Maxis
2008-01-08 20:57 . 2008-01-08 20:57 244 --ah-----
C:\sqmnoopt19.sqm
2008-01-08 20:57 . 2008-01-08 20:57 232 --ah-----
C:\sqmdata19.sqm
2007-12-22 16:32 . 2007-12-22 16:32 d-------- C:\Program
Files\Sierra
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report
))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-18 12:02 --------- d-----w C:\Documents and Settings\All
Users\Application Data\Avg7
2008-01-17 16:59 --------- d-----w C:\Documents and
Settings\Compaq_Administrator\Application Data\AVG7
2008-01-16 15:30 --------- d-----w C:\Documents and
Settings\Compaq_Administrator\Application Data\uTorrent
2008-01-14 16:00 --------- d-----w C:\Program Files\uTorrent
2008-01-11 07:39 --------- d-----w C:\Documents and
Settings\Compaq_Administrator\Application Data\foobar2000
2007-12-22 08:41 --------- d--h--w C:\Program Files\InstallShield
Installation Information
2007-11-07 09:26 721,920 ----a-w
C:\WINDOWS\system32\lsasrv.dll
2007-11-07 09:26 721,920 ----a-w
C:\WINDOWS\system32\dllcache\lsasrv.dll
2007-11-06 20:23 240,248 ----a-w
C:\WINDOWS\system32\wpcap.dll
2007-11-06 20:22 88,696 ----a-w
C:\WINDOWS\system32\Packet.dll
2007-11-06 20:22 68,224 ----a-w
C:\WINDOWS\system32\WanPacket.dll
2007-11-06 20:19 53,299 ----a-w
C:\WINDOWS\system32\pthreadVC.dll
2007-10-30 23:42 3,590,656 ----a-w
C:\WINDOWS\system32\dllcache\mshtml.dll
2007-10-30 17:20 360,064 ----a-w
C:\WINDOWS\system32\dllcache\tcpip.sys
2007-10-29 22:35 1,287,680 ----a-w
C:\WINDOWS\system32\quartz.dll
2007-10-29 22:35 1,287,680 ----a-w
C:\WINDOWS\system32\dllcache\quartz.dll
2007-10-27 09:40 222,720 ----a-w
C:\WINDOWS\system32\wmasf.dll
2007-10-27 09:40 222,720 ----a-w
C:\WINDOWS\system32\dllcache\wmasf.dll
2007-10-26 03:34 8,460,288 ----a-w
C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-22 10:39 43,520 ----a-w
C:\WINDOWS\system32\CmdLineExt03.dll
2007-07-30 10:16 106,943 ----a-w C:\WINDOWS\Internet
Logs\vsmon_2nd_2007_07_30_18_13_58_small.dmp.zip
2007-07-29 19:08 98,502 ----a-w C:\WINDOWS\Internet
Logs\vsmon_2nd_2007_07_30_03_05_34_small.dmp.zip
2007-06-18 16:47 97,878 ----a-w C:\WINDOWS\Internet
Logs\vsmon_2nd_2007_06_19_00_41_38_small.dmp.zip
2007-06-12 10:19 99,505 ----a-w C:\WINDOWS\Internet
Logs\vsmon_2nd_2007_06_12_18_19_26_small.dmp.zip
2007-06-10 14:59 96,182 ----a-w C:\WINDOWS\Internet
Logs\vsmon_2nd_2007_06_10_22_59_11_small.dmp.zip
2007-05-02 11:25 19,366,516 ----a-w C:\WINDOWS\Internet
Logs\vsmon_on_demand_2007_05_01_22_39_28_full.dmp.zip
2007-05-02 10:31 18,587,570 ----a-w C:\WINDOWS\Internet
Logs\vsmon_on_demand_2007_05_01_22_38_49_full.dmp.zip
2007-05-02 10:30 97,883 ----a-w C:\WINDOWS\Internet
Logs\vsmon_2nd_2007_05_01_22_38_59_small.dmp.zip
2007-05-02 10:30 97,475 ----a-w C:\WINDOWS\Internet
Logs\vsmon_2nd_2007_05_01_22_39_35_small.dmp.zip
2007-04-06 11:38 18,107,535 ----a-w C:\WINDOWS\Internet
Logs\vsmon_on_demand_2007_04_06_19_35_23_full.dmp.zip
2007-03-25 02:46 53,200 ----a-w C:\Documents and
Settings\Compaq_Administrator\Application
Data\GDIPFONTCACHEV1.DAT
2006-02-18 17:28 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
2007-04-10 03:10 8 --sh--r C:\WINDOWS\system32\8F0469B1C5.sys
2007-04-10 03:16 952 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-07-30 12:34 11,404,320 --sha-w
C:\WINDOWS\system32\drivers\fidbox.dat
2007-07-30 12:34 865,056 --sha-w
C:\WINDOWS\system32\drivers\fidbox2.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points
))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not
shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 05:00
15360]
"swg"="C:\Program
Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
[2007-06-22 20:39 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-21 01:06
7622656]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-22 19:58
579072]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware
7.5\avgas.exe" [2007-06-11 17:25 6731312]
"SunJavaUpdateSched"="C:\Program
Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11
132496]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 13:14
237568]
"nwiz"="nwiz.exe" [2006-06-21 01:06 1519616
C:\WINDOWS\system32\nwiz.exe]
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot
Optimizer\HPBootOp.exe" [2006-02-15 13:34 249856]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-02 14:19
77312 C:\WINDOWS\arpwrmsg.exe]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader
8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
C:\Documents and Settings\All Users\Start
Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft
Office\Office10\OSA.EXE [2001-02-13 01:01:04]
National University of Singapore NUS-VPN Client.lnk - C:\Program
Files\National University of Singapore\NUS-VPN
Client\ipsecdialer.exe [2007-09-01 09:41:53]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=
C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start
Menu^Programs^Startup^Compaq Connections.lnk]
path=C:\Documents and Settings\All Users\Start
Menu\Programs\Startup\Compaq Connections.lnk
backup=C:\WINDOWS\pss\Compaq Connections.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and
Settings^Compaq_Administrator^Start Menu^Programs^Startup^Adobe
Gamma.lnk]
path=C:\Documents and Settings\Compaq_Administrator\Start
Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader
8.0\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-10 05:00 15360
C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\ehTray]
--a------ 2005-08-05 11:56 64512 C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\ftutil2]
--a------ 2004-06-07 05:05 106496
C:\WINDOWS\system32\ftutil2.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\HP Software Update]
--a------ 2005-02-16 21:11 49152 C:\Program Files\HP\HP Software
Update\HPwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 2004-08-10 05:00 208952
C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\MSPY2002]
--a------ 2004-08-10 05:00 59392
C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\NvCplDaemon]
--a------ 2006-06-21 01:06 7622656
C:\WINDOWS\system32\NvCpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\PCDrProfiler]
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\PHIME2002A]
--a------ 2004-08-10 05:00 455168
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\PHIME2002ASync]
--a------ 2004-08-10 05:00 455168
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\Reminder]
--a------ 2004-12-13 17:23 663552
C:\Windows\Creator\Remind_XP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\RTHDCPL]
--a------ 2006-07-22 00:56 16261632 C:\WINDOWS\RTHDCPL.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\swg]
--a------ 2007-06-22 20:39 68856 C:\Program
Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
R2 CVPNDRV;National University of Singapore IPsec
Driver;C:\WINDOWS\system32\Drivers\CVPNDRV.sys [2003-03-26
14:57]
R2 WUSB54Gv42SVC;WUSB54Gv42SVC;"C:\Program Files\Linksys Wireless-G
USB Wireless Network Monitor\WLService.exe" "WUSB54Gv42.exe"
[]
R3 WUSB54GPV4SRV;Linksys Home Wireless-G USB Adaptor
Driver;C:\WINDOWS\system32\DRIVERS\rt2500usb.sys [2005-04-13
16:31]
S3 CSNPD51;CSNPD51 NDIS Protocol
Driver;C:\WINDOWS\system32\Drivers\CSNPD51.sys [2007-10-17
17:04]
S3 CSNPD51a64;CSNPD51a64 NDIS Protocol
Driver;C:\WINDOWS\system32\Drivers\CSNPD51a64.sys []
S3 marlbus;NEC WMC USB_AD1 Composite Device driver
(WDM);C:\WINDOWS\system32\DRIVERS\marlbus.sys [2005-08-25
23:19]
S3 marlmdfl;NEC WMC USB_AD1 Modem
Filter;C:\WINDOWS\system32\DRIVERS\marlmdfl.sys [2005-08-25
23:20]
S3 marlmdm;NEC WMC USB_AD1 Modem
Drivers;C:\WINDOWS\system32\DRIVERS\marlmdm.sys [2005-08-25
23:20]
S3 marlobex;NEC WMC USB_AD1 OBEX Interface Drivers
(WDM);C:\WINDOWS\system32\DRIVERS\marlobex.sys [2005-08-25
23:20]
S3 NPF;NetGroup Packet Filter
Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-11-07 04:22]
S3 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL
Server\90\Shared\sqlwriter.exe" [2005-10-14 03:53]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;"C:\Program
Files\Microsoft Visual Studio 8\Common7\IDE\Remote
Debugger\x86\msvsmon.exe" [2005-09-23 07:01]
*Newly Created Service* - GTNDIS5
*Newly Created Service* - PROCEXP90
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by
Gmer, http://www.gmer.net
Rootkit scan 2008-01-18 23:42:13
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-18 23:42:46
ComboFix-quarantined-files.txt 2008-01-18 15:42:44
.
2008-01-16 16:00:48 --- E O F ---
