ComboFix 08-08-23.03 - crystal 08/24/2008 13:16:56.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.241 [GMT 3:00]
Running from: C:\Documents and Settings\crystal\My Documents\Downloads\Programs\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS.0\msvrc20.dll
D:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-07-24 to 2008-08-24 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-24 10:21 6,180,640 --sha-w C:\WINDOWS.0\system32\drivers\fidbox.dat
2008-08-24 10:21 --------- d-----w C:\Documents and Settings\crystal\Application Data\DMCache
2008-08-24 10:20 65,312 --sha-w C:\WINDOWS.0\system32\drivers\fidbox2.dat
2008-08-24 09:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-24 09:17 --------- d-----w C:\Documents and Settings\شهد\Application Data\DMCache
2008-08-23 23:06 92,300 --sha-w C:\WINDOWS.0\system32\drivers\fidbox.idx
2008-08-23 23:06 7,712 --sha-w C:\WINDOWS.0\system32\drivers\fidbox2.idx
2008-08-23 21:02 --------- d-----w C:\Documents and Settings\crystal\Application Data\Azureus
2008-08-23 15:30 --------- d-----w C:\Documents and Settings\crystal\Application Data\BSplayer
2008-08-23 10:39 --------- d-----w C:\Program Files\Microsoft Works
2008-08-20 12:43 112,144 ----a-w C:\WINDOWS.0\system32\drivers\kl1.sys
2008-08-20 12:42 96,976 ----a-w C:\WINDOWS.0\system32\drivers\klin.dat
2008-08-20 12:42 87,855 ----a-w C:\WINDOWS.0\system32\drivers\klick.dat
2008-08-20 11:28 --------- d-----w C:\Program Files\Kaspersky Lab
2008-08-20 11:21 --------- d-----w C:\Program Files\ESET
2008-08-19 22:09 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-08-19 22:09 --------- d-----w C:\Documents and Settings\crystal\Application Data\Malwarebytes
2008-08-19 22:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-19 16:33 --------- d-----w C:\Program Files\Easy Photo Recovery
2008-08-17 14:26 --------- d-----w C:\Program Files\ShaPlus Google Translator
2008-08-17 12:04 38,472 ----a-w C:\WINDOWS.0\system32\drivers\mbamswissarmy.sys
2008-08-17 12:04 17,144 ----a-w C:\WINDOWS.0\system32\drivers\mbam.sys
2008-08-16 23:22 --------- d-----w C:\Program Files\IObit
2008-08-16 23:22 --------- d-----w C:\Documents and Settings\crystal\Application Data\uTorrent
2008-08-16 23:20 --------- d-----w C:\Program Files\MSXML 6.0
2008-08-16 23:12 --------- d-----w C:\Program Files\MSXML 4.0
2008-08-16 22:58 --------- d-----w C:\Program Files\Azureus
2008-08-15 21:55 --------- d-----w C:\Program Files\BandRich
2008-08-15 12:04 --------- d-----w C:\Program Files\Stepok's Gigital Beauty
2008-08-14 14:35 --------- d-----w C:\Program Files\Google
2008-08-09 11:35 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-06 16:31 --------- d-----w C:\Program Files\JetAudio
2008-08-04 16:00 --------- d-----w C:\Program Files\Bit Che
2008-08-04 16:00 --------- d-----w C:\Documents and Settings\crystal\Application Data\Convivea
2008-08-04 15:46 360,576 ----a-w C:\WINDOWS.0\system32\drivers\TCPIP.SYS.ORIGINAL
2008-07-31 11:31 --------- d-----w C:\Program Files\Abadisoft
2008-07-31 11:24 --------- d-----w C:\Program Files\Internet Download Manager
2008-07-31 11:24 --------- d-----w C:\Documents and Settings\crystal\Application Data\IDM
2008-07-21 22:08 --------- d-----w C:\Documents and Settings\crystal\Application Data\COWON
2008-07-21 22:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-21 22:07 --------- d-----w C:\Program Files\Common Files\COWON
2008-07-21 22:06 --------- d-----w C:\Documents and Settings\crystal\Application Data\InstallShield
2008-07-21 21:28 --------- d-----w C:\Program Files\Nalsoft
2008-07-18 22:12 --------- d-----w C:\Program Files\XoftSpySE
2008-07-17 12:37 --------- d-----w C:\Program Files\CCleaner
2008-07-12 10:25 --------- d-----w C:\Documents and Settings\شهد\Application Data\IDM
2008-07-10 10:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS.0\system32\es.dll
2008-07-07 20:32 253,952 ------w C:\WINDOWS.0\system32\dllcache\es.dll
2008-07-07 20:02 --------- d-----w C:\Program Files\Hotspot Shield
2008-07-06 14:40 --------- d-----w C:\Program Files\DAEMON Tools
2008-07-06 12:19 --------- d-----w C:\Program Files\Doctor Alex
2008-07-06 11:23 --------- d-----w C:\Program Files\Real
2008-07-06 11:23 --------- d-----w C:\Program Files\Common Files\xing shared
2008-07-06 11:22 499,712 ----a-w C:\WINDOWS.0\system32\msvcp71.dll
2008-07-06 11:22 348,160 ----a-w C:\WINDOWS.0\system32\msvcr71.dll
2008-07-06 11:22 --------- d-----w C:\Program Files\Common Files\Real
2008-07-04 13:59 --------- d-----w C:\Documents and Settings\شهد\Application Data\GRETECH
2008-07-01 19:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Azureus
2008-07-01 16:05 --------- d-----w C:\Program Files\Common Files\GuruNet Shared
2008-07-01 16:05 --------- d-----w C:\Program Files\Common Files\Accent Shared
2008-06-30 06:56 --------- d-----w C:\Program Files\Windows Live
2008-06-30 06:56 --------- d-----w C:\Program Files\MSN Messenger
2008-06-30 06:56 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-06-29 19:16 --------- d-----w C:\Program Files\TuneUp Utilities 2006
2008-06-29 10:15 --------- d-----w C:\Program Files\VerbAce Research
2008-06-29 10:09 --------- d-----w C:\Program Files\Ectaco
2008-06-28 21:42 --------- d-----w C:\Program Files\AdVantage
2008-06-28 17:19 --------- d-----w C:\Documents and Settings\crystal\Application Data\Skype
2008-06-28 16:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-06-28 16:07 --------- d-----w C:\Program Files\uTorrent
2008-06-28 16:06 --------- d-----w C:\Program Files\Yahoo!
2008-06-28 15:28 --------- d-----w C:\Program Files\Skype
2008-06-28 15:28 --------- d-----w C:\Program Files\Common Files\Skype
2008-06-28 15:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-06-28 15:03 4,608 ----a-w C:\WINDOWS.0\system32\w95inf32.dll
2008-06-28 15:03 2,272 ----a-w C:\WINDOWS.0\system32\w95inf16.dll
2008-06-28 15:02 --------- d-----w C:\Program Files\Auralog
2008-06-28 15:01 223,128 ----a-w C:\WINDOWS.0\system32\drivers\dtscsi.sys
2008-06-28 14:54 96,256 ----a-w C:\WINDOWS.0\system32\drivers\sptd0925.sys
2008-06-28 14:54 642,560 ----a-w C:\WINDOWS.0\system32\drivers\sptd.sys
2008-06-28 14:48 --------- d-----w C:\Documents and Settings\crystal\Application Data\GRETECH
2008-06-28 14:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\GRETECH
2008-06-28 14:25 --------- d-----w C:\Program Files\Microsoft.NET
2008-06-28 14:25 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-06-28 14:25 --------- d-----w C:\Program Files\Common Files\L&H
2008-06-28 08:18 --------- d-----w C:\Program Files\Java
2008-06-28 08:07 --------- d-----w C:\Program Files\Common Files\Java
2008-06-27 13:21 --------- d-----w C:\Program Files\QuickWiz
2008-06-27 13:20 155,995 ----a-w C:\WINDOWS.0\java\Packages\O613N9FN.ZIP
2008-06-27 13:18 --------- d-----w C:\Program Files\Webteh
2008-06-27 13:18 --------- d-----w C:\Program Files\GRETECH
2008-06-27 13:18 --------- d-----w C:\Documents and Settings\crystal\Application Data\BSplayer Pro
2008-06-27 13:15 --------- d-----w C:\Documents and Settings\crystal\Application Data\Media Player Classic
2008-06-27 13:12 --------- d-----w C:\Program Files\Synaptics
2008-06-27 13:10 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-27 13:09 --------- d-----w C:\Program Files\Intel
2008-06-27 12:29 --------- d-----w C:\Program Files\SpiritPyre Extensions
2008-06-27 12:29 --------- d-----w C:\Program Files\SageThumbs
2008-06-27 12:29 --------- d-----w C:\Program Files\Rainmeter
.
------- Sigcheck -------
03/08/2007 06:36 PM 577536 b409909f6e2e8a7067076ed748abf1e7 C:\WINDOWS.0\SoftwareDistribution\Download\4d9d678c0d8af22c04a4a7fc7f1ff86c\SP2GDR\user32.dll
03/08/2007 06:48 PM 578048 7aa4f6c00405dfc4b70ed4214e7d687b C:\WINDOWS.0\SoftwareDistribution\Download\4d9d678c0d8af22c04a4a7fc7f1ff86c\SP2QFE\user32.dll
12/07/2006 05:12 AM 577024 1800f293bccc8ede8a70e12b88d80036 C:\WINDOWS.0\system32\user32.dll
12/07/2006 05:41 AM 818688 7cf0b0d5d9d47585853e2a6978441f64 C:\WINDOWS.0\system32\wininet.dll
02/28/2007 11:38 AM 2057600 515d30e2c90a3665a2739309334c9283 C:\WINDOWS.0\SoftwareDistribution\Download\10e16e65c532d077de7c89a212bd8df8\SP2GDR\ntkrnlpa.exe
02/28/2007 01:15 AM 2059392 4d3dbdccbf97f5ba1e74f322b155c3ba C:\WINDOWS.0\SoftwareDistribution\Download\10e16e65c532d077de7c89a212bd8df8\SP2QFE\ntkrnlpa.exe
12/07/2006 08:50 AM 2058368 d20855e9a650415e4f65e0ce249839bd C:\WINDOWS.0\system32\ntkrnlpa.exe
02/28/2007 12:10 PM 2180352 582a8dbaa58c3b1f176eb2817daee77c C:\WINDOWS.0\SoftwareDistribution\Download\10e16e65c532d077de7c89a212bd8df8\SP2GDR\ntoskrnl.exe
02/28/2007 12:55 PM 2182144 5a5c8db4aa962c714c8371fbdf189fc9 C:\WINDOWS.0\SoftwareDistribution\Download\10e16e65c532d077de7c89a212bd8df8\SP2QFE\ntoskrnl.exe
12/14/2006 04:52 AM 2178176 dd16419f1c0bad21859ddafad9380c2d C:\WINDOWS.0\system32\ntoskrnl.exe
12/13/2006 05:58 AM 3747840 e00a8b6f4383d8ca5f41aa39e53e37d0 C:\WINDOWS.0\explorer.exe
06/13/2007 01:23 PM 1033216 97bd6515465659ff8f3b7be375b2ea87 C:\WINDOWS.0\SoftwareDistribution\Download\44d74c37f0595a363bcec5e9229d8564\SP2GDR\explorer.exe
06/13/2007 02:26 PM 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS.0\SoftwareDistribution\Download\44d74c37f0595a363bcec5e9229d8564\SP2QFE\explorer.exe
12/07/2006 05:11 AM 57856 ad3d9d191aea7b5445fe1d82ffbb4788 C:\WINDOWS.0\system32\spoolsv.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS.0\system32\ctfmon.exe" [08/05/2004 10:56 AM 15360]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [01/10/2008 10:59 PM 2577840]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [01/19/2007 12:55 PM 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [07/06/2008 02:22 PM 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS.0\system32\CTFMON.EXE" [08/05/2004 10:56 AM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMBalloonTip"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMBalloonTip"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office OneNote 2003 Quick Launch.lnk
backup=C:\WINDOWS.0\pss\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Rainmeter.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Rainmeter.lnk
backup=C:\WINDOWS.0\pss\Rainmeter.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VerbAce-Pro Startup Agent.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VerbAce-Pro Startup Agent.lnk
backup=C:\WINDOWS.0\pss\VerbAce-Pro Startup Agent.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^بدء التشغيل السريع لـ Microsoft Office OneNote 2003.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\بدء التشغيل السريع لـ Microsoft Office OneNote 2003.lnk
backup=C:\WINDOWS.0\pss\بدء التشغيل السريع لـ Microsoft Office OneNote 2003.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\abadisoft.winutility]
--a------ 01/20/2008 06:37 PM 2022400 C:\Program Files\Abadisoft\WinUtility\Abadisoft.WinUtilites.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 01/11/2008 10:16 PM 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
-ra------ 03/01/2007 10:37 AM 2321600 C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage]
--a------ 11/05/2007 11:12 AM 884176 C:\Program Files\AdVantage\AdVantage.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AFProg]
--a------ 06/26/2006 05:26 AM 118784 C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVP]
--a------ 02/08/2008 06:36 PM 227856 C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 08/05/2004 10:56 AM 15360 C:\WINDOWS.0\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
--a------ 12/10/2005 05:57 PM 133016 C:\Program Files\DAEMON Tools\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a------ 04/06/2003 11:07 PM 114688 C:\WINDOWS.0\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 01/10/2008 10:59 PM 2577840 C:\Program Files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a------ 04/06/2003 11:19 PM 155648 C:\WINDOWS.0\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 01/19/2007 12:55 PM 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 08/17/2007 03:45 AM 23120680 C:\Program Files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a------ 04/24/2003 03:44 PM 610304 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
--a------ 04/24/2003 03:51 PM 110592 C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 07/06/2008 02:22 PM 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
--a------ 02/14/2003 10:59 AM 88107 C:\WINDOWS.0\AGRSMMSG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\kav\\kav7.0\\english\\setup.exe"=
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"=
R2 BandLuxe_Service;BandLuxe Service;C:\Program Files\BandRich\BandLuxe HSDPA Utility R11\BRService.exe [04/15/2008 12:26 PM]
R2 HotspotShieldService;Hotspot Shield Service;C:\Program Files\Hotspot Shield\bin\openvpnas.exe [12/17/2006 06:08 AM]
R2 irda;IrDA Protocol;C:\WINDOWS.0\system32\DRIVERS\irda.sys [08/04/2004 02:00 AM]
R2 Irmon;Infrared Monitor;C:\WINDOWS.0\system32\svchost.exe [08/05/2004 10:56 AM]
R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS.0\System32\svchost.exe [08/05/2004 10:56 AM]
R3 {E2B953A6-195A-44F9-9BA3-3D5F4E32BB55};AIM 3.0 Part 01 Codec Driver CH-7009-A/CH-7011;C:\WINDOWS.0\system32\drivers\wA301a.sys [04/23/2003 09:10 AM]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver;C:\WINDOWS.0\system32\DRIVERS\bcm4sbxp.sys [01/30/2007 12:12 PM]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS.0\system32\DRIVERS\klim5.sys [12/13/2007 01:28 PM]
R3 NSCIRDA;NSC Infrared Device Driver;C:\WINDOWS.0\system32\DRIVERS\nscirda.sys [08/04/2004 02:00 AM]
R3 Rasirda;WAN Miniport (IrDA);C:\WINDOWS.0\system32\DRIVERS\rasirda.sys [08/17/2001 04:51 PM]
R3 SynTP;Synaptics TouchPad Driver;C:\WINDOWS.0\system32\DRIVERS\SynTP.sys [04/24/2003 03:08 PM]
R3 tapvpn;TAP VPN Adapter;C:\WINDOWS.0\system32\DRIVERS\tapvpn.sys [12/16/2006 11:37 PM]
R3 w70n51;Intel(R) PRO/Wireless 7100 Adapter Driver;C:\WINDOWS.0\system32\DRIVERS\w70n51.sys [10/13/2003 06:11 AM]
R3 WBMS;Winbond Memory Stick Storage (MS) Device Driver;C:\WINDOWS.0\system32\Drivers\WBMS.SYS [11/07/2002 07:48 PM]
R3 WBSD;Winbond Secure Digital Storage (SD/MMC) Device Driver;C:\WINDOWS.0\system32\Drivers\WBSD.SYS [11/28/2002 05:04 PM]
S3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB;C:\WINDOWS.0\system32\DRIVERS\br3gmdm.sys [03/14/2008 10:31 AM]
S3 cs429x;Cirrus Logic WDM Audio Codec Driver;C:\WINDOWS.0\system32\drivers\cwawdm.sys [07/14/2003 04:33 PM]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - H:\AutoRun.exe TMM80
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
s of the 'Scheduled Tasks' folder
2008-08-22 C:\WINDOWS.0\Tasks\1-Click Maintenance.job
- C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe [10/05/2006 04:09 PM]
2008-08-24 C:\WINDOWS.0\Tasks\XoftSpySE 2.job
- C:\Program Files\XoftSpySE\XoftSpy.exe [10/24/2007 09:59 PM]
2008-08-24 C:\WINDOWS.0\Tasks\XoftSpySE.job
- C:\Program Files\XoftSpySE\XoftSpy.exe [10/24/2007 09:59 PM]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\crystal\Application Data\Mozilla\Firefox\Profiles\450zxolx.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://ar.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:ar
fficial
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-08-24 13:21:10
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 08/24/2008 13:23:13
ComboFix-quarantined-files.txt 2008-08-24 10:23:08
Pre-Run: 5,499,678,720 bytes free
Post-Run: 5,510,967,296 bytes free
280 --- E O F --- 2008-08-23 10:53:50
