ComboFix 07-12-21.4 - cindy 2007-12-29 16:05:44.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.88 [GMT
8:00]
Running from: C:\Documents and
Settings\cindy\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions
)))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\cindy\Application Data\FNTS~1
C:\Documents and Settings\cindy\Application Data\ICROSO~1.NET
C:\Documents and Settings\cindy\Application Data\macromedia\Flash
Player\#SharedObjects\M2MJUXVG\www.broadcaster.com
C:\Documents and Settings\cindy\Application Data\macromedia\Flash
Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\cindy\Application Data\macromedia\Flash
Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Documents and Settings\cindy\Application Data\SSEMBL~1
C:\Documents and Settings\cindy\Start Menu\Programs\Outerinfo
C:\Documents and Settings\cindy\Start
Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\cindy\Start
Menu\Programs\Outerinfo\Uninstall.lnk
C:\Program Files\Common Files\ecurit~1
C:\Program Files\Common Files\misc001
C:\Program Files\Common Files\simtest
C:\Program Files\Common Files\simtest\svchostsys.bat
C:\Program Files\Common Files\simtest\temp.txt
C:\Program Files\Common Files\svchostsys
C:\Program Files\Common
Files\svchostsys\ICSharpCode.SharpZipLib.dll
C:\Program Files\Common
Files\svchostsys\svchostsys.exe.config
C:\Program Files\Common
Files\svchostsys\svchostupdate.exe.config
C:\Program Files\Common Files\svchostsys\Version.txt
C:\Program Files\curity~1
C:\Program Files\ecurit~1
C:\Program Files\outerinfo
C:\Program Files\outerinfo\FF\chrome.manifest
C:\Program Files\outerinfo\FF\components\FF.dll
C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt
C:\Program Files\outerinfo\FF\install.rdf
C:\Program Files\outerinfo\OiUninstaller.exe
C:\Program Files\outerinfo\outerinfo.ico
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\scurit~1
C:\Program Files\sstem~1
C:\Program Files\ystem3~1
C:\WINDOWS\asembl~1
C:\WINDOWS\crosof~1.net
C:\WINDOWS\crosof~1.net\?hkntfs.exe
C:\WINDOWS\dobe~1
C:\WINDOWS\icroso~1.net
C:\WINDOWS\keyboard1.dat
C:\WINDOWS\newname.dat
C:\WINDOWS\racle~1
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\guard.tmp
C:\WINDOWS\system32\icroso~1
C:\WINDOWS\system32\mantec~1
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\pppatc~1
C:\WINDOWS\system32\pthreadVC.dll
C:\WINDOWS\system32\scurit~1
C:\WINDOWS\system32\WanPacket.dll
C:\WINDOWS\system32\wpcap.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services
)))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_NETWORK_MONITOR
-------\NPF
((((((((((((((((((((((((( Files Created from 2007-11-28 to
2007-12-29 )))))))))))))))))))))))))))))))
.
2007-12-29 15:48 . 2007-12-29 15:48 d-------- C:\Documents and
Settings\cindy\Application Data\SiteAdvisor
2007-12-29 15:48 . 2007-12-29 15:48 d-------- C:\Documents and
Settings\All Users\Application Data\SiteAdvisor
2007-12-29 15:48 . 2007-12-29 15:48 d-------- C:\Documents and
Settings\All Users\Application Data\McAfee
2007-12-29 15:09 . 2007-12-29 15:08 512,096 --a------
C:\WINDOWS\system32\drivers\amon.sys
2007-12-29 15:09 . 2007-12-29 15:08 298,104 --a------
C:\WINDOWS\system32\imon.dll
2007-12-29 15:09 . 2007-12-29 15:08 15,424 --a------
C:\WINDOWS\system32\drivers\nod32drv.sys
2007-12-29 14:10 . 2007-12-29 14:10 d-------- C:\Documents and
Settings\cindy\Application Data\Grisoft
2007-12-29 14:10 . 2007-12-29 14:10 d-------- C:\Documents and
Settings\All Users\Application Data\Grisoft
2007-12-29 14:10 . 2007-05-30 20:10 10,872 --a------
C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-12-29 14:01 . 2007-12-29 14:01 d-------- C:\Program
Files\Trend Micro
2007-12-27 13:32 . 2007-12-27 13:32 d-------- C:\Program Files\Veoh
Networks
2007-12-04 22:45 . 2007-12-04 22:45 d--hs---- C:\FOUND.002
2007-12-02 20:21 . 2007-12-29 15:40 664 --a------
C:\WINDOWS\system32\d3d9caps.dat
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report
))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-21 06:37 --------- d-----w C:\Program Files\MSECache
2007-11-14 07:26 450,560 ----a-w
C:\WINDOWS\system32\dllcache\jscript.dll
2007-11-13 10:25 20,480 ----a-w
C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-30 10:16 3,058,688 ----a-w
C:\WINDOWS\system32\dllcache\mshtml.dll
2007-10-29 22:43 1,287,680 ----a-w
C:\WINDOWS\system32\quartz.dll
2007-10-29 22:43 1,287,680 ----a-w
C:\WINDOWS\system32\dllcache\quartz.dll
2007-10-27 09:39 230,912 ----a-w
C:\WINDOWS\system32\wmasf.dll
2007-10-27 09:39 230,912 ----a-w
C:\WINDOWS\system32\dllcache\wmasf.dll
2007-10-27 09:37 2,109,440 ----a-w
C:\WINDOWS\system32\dllcache\wmvcore.dll
2007-10-26 03:36 8,454,656 ----a-w
C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-11 06:13 96,256 ----a-w
C:\WINDOWS\system32\dllcache\inseng.dll
2007-10-11 06:13 659,456 ----a-w
C:\WINDOWS\system32\dllcache\wininet.dll
2007-10-11 06:13 615,424 ----a-w
C:\WINDOWS\system32\dllcache\urlmon.dll
2007-10-11 06:13 55,808 ----a-w
C:\WINDOWS\system32\dllcache\extmgr.dll
2007-10-11 06:13 532,480 ----a-w
C:\WINDOWS\system32\dllcache\mstime.dll
2007-10-11 06:13 474,112 ----a-w
C:\WINDOWS\system32\dllcache\shlwapi.dll
2007-10-11 06:13 449,024 ----a-w
C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-10-11 06:13 39,424 ----a-w
C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-10-11 06:13 357,888 ----a-w
C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-10-11 06:13 251,392 ----a-w
C:\WINDOWS\system32\dllcache\iepeers.dll
2007-10-11 06:13 205,312 ----a-w
C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-10-11 06:13 16,384 ----a-w
C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-10-11 06:13 151,040 ----a-w
C:\WINDOWS\system32\dllcache\cdfview.dll
2007-10-11 06:13 146,432 ----a-w
C:\WINDOWS\system32\dllcache\msrating.dll
2007-10-11 06:13 1,494,528 ----a-w
C:\WINDOWS\system32\dllcache\shdocvw.dll
2007-10-11 06:13 1,054,208 ----a-w
C:\WINDOWS\system32\dllcache\danim.dll
2007-10-11 06:13 1,023,488 ----a-w
C:\WINDOWS\system32\dllcache\browseui.dll
2007-10-10 11:16 18,432 ----a-w
C:\WINDOWS\system32\dllcache\iedw.exe
2006-04-29 21:31 0 ----a-w C:\Documents and
Settings\cindy\Application Data\wklnhst.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points
))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not
shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{B15A4C6B-D8F9-DE7B-D908-8BADAFE97792}]
C:\WINDOWS\system32\ktg.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{C6F8F961-61FE-6A7D-DA28-39E6048903C4}]
C:\WINDOWS\system32\pmsrcu.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04
05:00]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19
12:54]
"Bwer"="C:\PROGRA~1\CURITY~1\wuaclt.exe" []
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-08-21
17:42]
"Nkhalcl"="C:\WINDOWS\??crosoft.NET\?hkntfs.exe" []
"ares"="C:\Program Files\Ares\Ares.exe" []
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe"
[2007-12-19 16:31]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-03-21
22:57]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-03-21
22:53]
"LaunchApp"="Alaunch" []
"SoundMan"="SOUNDMAN.EXE" [2005-03-24 21:20
C:\WINDOWS\SOUNDMAN.EXE]
"KTPWare"="C:\Program Files\Elantech\ktp.exe" [2005-10-27
11:50]
"PCMService"="C:\Program Files\Acer\Acer Arcade\PCMService.exe"
[2005-08-31 19:59]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 05:00
C:\WINDOWS\system32\bthprops.cpl]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04
05:00]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe"
[2004-08-04 05:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe"
[2004-08-04 05:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe"
[2004-08-04 05:00]
"eDataSecurity Loader"="C:\Acer\Empowering
Technology\eDataSecurity\eDSloader.exe" [2005-10-19 09:30]
"EPM-DM"="c:\acer\Empowering Technology\ePower\epm-dm.exe"
[2005-11-25 15:59]
"Acer ePower Management"="C:\Acer\Empowering Technology\ePower\Acer
ePower Management.exe" [2005-11-09 11:04]
"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2005-11-04
10:46]
"eRecoveryService"="C:\Acer\Empowering
Technology\eRecovery\Monitor.exe" [2005-11-16 17:00]
"ADMTray.exe"="C:\Acer\Empowering Technology\admtray.exe"
[2005-10-24 16:45]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
[2006-02-23 16:45]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe"
[2006-05-15 21:20]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19
17:32]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe"
[2005-06-08 15:24]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe"
[2005-06-08 15:14]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
[2005-10-04 12:42]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-11-15 13:28]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware
7.5\avgas.exe" [2007-06-11 17:25]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-12-29
15:08]
C:\Documents and Settings\All Users\Start
Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat
7.0\Reader\reader_sl.exe [2004-12-14 04:44:06]
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth
Software\BTTray.exe [2005-12-02 14:30:42]
R0 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys
[2004-12-17 16:14]
R1 OsaFsLoc;OsaFsLoc;C:\WINDOWS\system32\drivers\OsaFsLoc.sys
[2005-10-15 18:20]
R2 DritekPortIO;Dritek General Port
I/O;C:\PROGRA~1\LAUNCH~1\DPortIO.sys [2004-12-15 14:22]
R2 EpmPsd;Acer EPM Power Scheme
Driver;C:\WINDOWS\system32\drivers\epm-psd.sys [2004-07-19
13:10]
R2 EpmShd;Acer EPM System Hardware
Driver;C:\WINDOWS\system32\drivers\epm-shd.sys [2005-04-07
18:08]
R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys [2005-06-30
16:58]
R2 osanbm;osanbm;C:\WINDOWS\system32\drivers\osanbm.sys [2005-01-14
15:57]
R3 DKbFltr;Dritek Keyboard Filter
Driver;C:\WINDOWS\system32\DRIVERS\DKbFltr.sys [2004-12-08
14:10]
R3 Ktp;Elantech Touchpad;C:\WINDOWS\system32\DRIVERS\Ktp.sys
[2005-08-03 19:04]
R3 NdisFilt;OSA NdisFilter
Protocol;C:\WINDOWS\system32\Drivers\NdisFilt.sys [2005-09-13
15:34]
S3 EMSCR;EMSCR;C:\WINDOWS\system32\DRIVERS\EMS7SK.sys [2005-01-13
10:04]
S3 ESDCR;ESDCR;C:\WINDOWS\system32\DRIVERS\ESD7SK.sys [2005-04-28
16:26]
S3 ESMCR;ESMCR;C:\WINDOWS\system32\DRIVERS\ESM7SK.sys [2005-04-27
10:53]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d77fe38-b361-11dc-be67-000fb0f08121}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE
Shell32.DLL,ShellExec_RunDLL Setup.pif
.
**************************************************************************
catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by
Gmer, http://www.gmer.net
Rootkit scan 2007-12-29 16:11:54
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-12-29 16:13:55 - machine was rebooted
.
2007-12-26 15:26:37 --- E O F ---
