ComboFix 08-09-19.05 - user 09/20/2008 1:50:56.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1033.18.1594 [GMT 3:00]
Running from: C:\Documents and Settings\user\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-08-19 to 2008-09-19 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-19 21:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-09-19 21:50 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-19 21:48 --------- dc-h--w C:\Documents and Settings\All Users\Application Data\{6CF41A80-289A-4651-96E0-C4829485C662}
2008-09-19 21:43 --------- d-----w C:\Program Files\Common Files\Windows Live
2008-09-16 23:25 --------- d-----w C:\Program Files\a-squared Anti-Malware
2008-09-15 00:28 --------- d-----w C:\Documents and Settings\user\Application Data\CyberScrub
2008-09-15 00:27 --------- d-----w C:\Documents and Settings\user\Application Data\cleaner
2008-09-14 21:31 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-09-13 23:34 1,635 ----a-w C:\Documents and Settings\user\ktHcsHs.exe
2008-09-13 22:54 --------- d-----w C:\Program Files\NETGATE
2008-09-13 22:54 --------- d-----w C:\Program Files\Internet Download Manager
2008-09-13 22:54 --------- d-----w C:\Program Files\Common Files\xing shared
2008-09-13 22:54 --------- d-----w C:\Program Files\Common Files\Real
2008-09-13 22:54 --------- d-----w C:\Documents and Settings\user\Application Data\Toshiba
2008-09-13 22:54 --------- d-----w C:\Documents and Settings\user\Application Data\IDM
2008-09-13 22:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\NETGATE
2008-09-09 00:03 --------- d-----w C:\Program Files\MTC USB Connect
2008-09-06 23:22 --------- d-----w C:\Documents and Settings\user\Application Data\DMCache
2008-09-05 23:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-09-03 18:32 319,520 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-09-03 18:32 2,172 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-09-03 18:32 15,484 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-09-03 18:32 1,708,000 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-09-03 01:30 --------- d-----w C:\Documents and Settings\user\Application Data\Thinstall
2008-08-22 13:31 --------- d-----w C:\Program Files\Jap
2008-08-16 22:28 --------- d-----w C:\Program Files\NetCaptor
2008-08-16 22:28 --------- d-----w C:\Documents and Settings\user\Application Data\Stilesoft
2008-08-16 21:39 155,995 ----a-w C:\WINDOWS\java\Packages\six3vt7b.zip
2008-08-15 21:04 --------- d-----w C:\Program Files\Your Uninstaller 2008
2008-08-15 21:04 --------- d-----w C:\Program Files\Unlocker
2008-08-15 21:04 --------- d-----w C:\Program Files\Tweak Marketing
2008-08-15 21:04 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-08-15 21:04 --------- d-----w C:\Program Files\Paltalk Messenger
2008-08-15 21:04 --------- d-----w C:\Program Files\Mgutil
2008-08-15 21:04 --------- d-----w C:\Program Files\GVR
2008-08-15 21:04 --------- d-----w C:\Program Files\Free Download Manager
2008-08-15 21:04 --------- d-----w C:\Program Files\EleFun Desktops
2008-08-15 21:04 --------- d-----w C:\Program Files\CCleaner
2008-08-15 21:04 --------- d-----w C:\Documents and Settings\user\Application Data\Paltalk
2008-08-15 21:04 --------- d-----w C:\Documents and Settings\user\Application Data\Desktopicon
2008-08-15 21:03 --------- d-----w C:\Program Files\Real
2008-08-15 21:03 --------- d-----w C:\Program Files\Alwil Software
2008-08-15 21:01 --------- d-----w C:\Program Files\Spider
2008-08-14 21:01 --------- d-----w C:\Program Files\Golden Bow
2008-08-13 21:07 --------- d-----w C:\Program Files\VIVIplayer3
2008-08-09 21:49 155,995 ----a-w C:\WINDOWS\java\Packages\cslrpbtv.zip
2008-08-09 17:55 --------- d-----w C:\Documents and Settings\user\Application Data\URSoft
2008-08-09 17:50 --------- d-----w C:\Program Files\VS Revo Group
2008-07-30 00:29 --------- d-----w C:\Program Files\MSXML 6.0
2008-07-19 23:22 1,718,272 ----a-w C:\WINDOWS\system32\AnipUninst1.exe
2008-07-19 23:17 --------- d-----w C:\Documents and Settings\user\Application Data\elefundesktops
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 16:11 306,432 ----a-w C:\WINDOWS\system32\TuneUpDefragService.exe
2008-07-18 11:50 203,776 ----a-w C:\WINDOWS\system32\clrviddc.dll
2008-07-16 21:44 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-07-16 21:44 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-07-16 21:14 24,576 ------w C:\WINDOWS\system32\TSBWLS.dll
2008-07-16 19:53 8,464 ----a-w C:\WINDOWS\system32\SpOrder.dll
2008-07-16 19:37 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-07-11 08:55 712,704 ----a-w C:\WINDOWS\system32\windowscodecs.dll
2008-07-11 08:55 347,648 ----a-w C:\WINDOWS\system32\windowscodecsext.dll
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\dllcache\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-24 15:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-23 15:38 474,112 ----a-w C:\WINDOWS\system32\dllcache\shlwapi.dll
2008-06-23 15:38 151,040 ----a-w C:\WINDOWS\system32\dllcache\cdfview.dll
2008-06-23 15:38 1,494,528 ----a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
2008-06-23 15:38 1,054,208 ----a-w C:\WINDOWS\system32\dllcache\danim.dll
2008-06-23 15:38 1,023,488 ----a-w C:\WINDOWS\system32\dllcache\browseui.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2006-12-12 08:13 32,768 ----a-w C:\Documents and Settings\All Users\Application Data\EBLib.dll
2006-07-28 13:25 19,456 ----a-w C:\Documents and Settings\All Users\Application Data\LPCFilter.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 AM 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [02/12/2007 01:37 PM 174872]
"HWSetup"="C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe" [05/01/2004 01:45 PM 28672]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 10:50 AM 155648]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [12/07/2005 10:57 PM 30208]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [04/13/2006 11:09 AM 49152]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [11/10/2006 12:35 PM 90112]
"TPNF"="C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" [06/01/2007 05:40 AM 53248]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [11/20/2007 10:25 AM 888832]
"CeEKEY"="C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" [07/06/2007 06:49 AM 651264]
"DWPersistentQueuedReporting"="C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE" [03/13/2007 03:38 PM 39264]
"Ashampoo FireWall PRO"="C:\Program Files\Ashampoo\Ashampoo FireWall PRO\FireWall.exe" [12/21/2006 02:10 AM 3543552]
"a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [07/31/2008 02:46 PM 2131600]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [09/07/2008 10:59 PM 185896]
"TFncKy"="TFncKy.exe" [BU]
"TDispVol"="TDispVol.exe" [12/27/2005 01:06 PM 73728 C:\WINDOWS\system32\TDispVol.exe]
"RTHDCPL"="RTHDCPL.EXE" [12/28/2007 01:15 AM 16377344 C:\WINDOWS\RTHDCPL.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 03:56 AM 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-05-22 2756608]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PalTalk.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PalTalk.lnk
backup=C:\WINDOWS\pss\PalTalk.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [08/04/2004 03:56 AM 14336]
R3 DrvFltIp;DrvFltIp;C:\Documents and Settings\user\Local Settings\TEMP\DrvFltIp [ ]
S3 F-Secure Standalone Minifilter;F-Secure Standalone Minifilter;C:\DOCUME~1\user\LOCALS~1\Temp\OnlineScanner\Anti-Virus\fsgk.sys [ ]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [07/18/2008 07:11 PM 306432]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35c4cbee-7f38-11dd-880a-0013e852690b}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{48b98684-538e-11dd-8772-00037ac5d5d2}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{48b98685-538e-11dd-8772-00037ac5d5d2}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{732061dd-6b16-11dd-87a7-00037ac5d5d2}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{894cd572-7e02-11dd-8805-0013e852690b}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af098664-5370-11dd-876e-0013e852690b}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af098667-5370-11dd-876e-0013e852690b}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b7ce60f0-5585-11dd-8790-00037ac5d5d2}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b7ce60f1-5585-11dd-8790-00037ac5d5d2}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c1b05592-566b-11dd-8796-00037ac5d5d2}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c1b05593-566b-11dd-8796-00037ac5d5d2}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c7b9399e-6f17-11dd-87bf-00037ac5d5d2}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e1502ef2-6b17-11dd-87a8-00037ac5d5d2}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fc9a56a6-82af-11dd-8813-0013e852690b}]
\Shell\AutoRun\command - F:\AutoRun.exe
*Newly Created Service* - CATCHME
.
s of the 'Scheduled Tasks' folder
2008-08-22 C:\WINDOWS\Tasks\1-Click Maintenance.job
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe [12/21/2007 03:17 PM]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com/
O16 -: Microsoft XML Parser for Java -
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-09-20 01:51:45
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ASFWHide]
"ImagePath"="\??\C:\Documents and Settings\user\Local Settings\TEMP\ASFWHide"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\DrvFltIp]
"ImagePath"="\??\C:\Documents and Settings\user\Local Settings\TEMP\DrvFltIp"
.
Completion time: 09/20/2008 1:52:20
ComboFix-quarantined-files.txt 2008-09-19 22:52:15
ComboFix2.txt 2008-09-19 22:49:49
ComboFix3.txt 2008-08-16 19:59:57
Pre-Run: 60,163,133,440 bytes free
Post-Run: 60,147,666,944 bytes free
207 --- E O F --- 2008-09-19 14:40:42
