ComboFix 08-12-07.04 - OK450 2008-12-09 18:35:17.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1033.18.1444 [GMT 3:00]
Running from: c:\documents and settings\OK450\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\resycled
c:\resycled\boot.com
c:\windows\system32\l_except.nls
D:\Autorun.inf
D:\resycled
d:\resycled\boot.com
F:\resycled
f:\resycled\boot.com
.
((((((((((((((((((((((((( Files Created from 2008-11-09 to 2008-12-09 )))))))))))))))))))))))))))))))
.
2008-12-09 18:25 . 2008-12-09 18:25 <DIR> d-------- c:\documents and settings\OK450\Application Data\Media Player Classic
2008-12-09 18:25 . 2008-12-09 18:25 69 --a------ c:\windows\NeroDigital.ini
2008-12-09 17:33 . 2008-12-09 17:33 <DIR> d-------- c:\program files\MSBuild
2008-12-09 17:33 . 2008-12-09 17:33 <DIR> d-------- c:\program files\Microsoft Works
2008-12-09 17:33 . 2008-12-09 17:33 <DIR> d-------- c:\documents and settings\OK450\Application Data\FastStone
2008-12-09 17:31 . 2008-12-09 17:33 <DIR> d-------- c:\windows\SHELLNEW
2008-12-09 17:31 . 2008-12-09 17:31 <DIR> dr-h----- C:\MSOCache
2008-12-09 17:31 . 2008-12-09 17:34 <DIR> d-------- c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-09 12:05 . 2006-03-17 12:45 1,757,184 --a------ c:\windows\system32\imagX7.dll
2008-12-09 12:05 . 2006-03-17 12:45 802,816 --a------ c:\windows\system32\imagXRA7.dll
2008-12-09 12:05 . 2006-03-17 12:45 497,296 --a------ c:\windows\system32\imagXpr7.dll
2008-12-09 12:05 . 2006-03-17 15:49 368,640 --a------ c:\windows\system32\TwnLib4.dll
2008-12-09 12:05 . 2006-03-17 12:45 258,048 --a------ c:\windows\system32\imagXR7.dll
2008-12-09 12:04 . 2008-12-09 12:05 <DIR> d-------- c:\program files\Nero
2008-12-09 12:04 . 2008-12-09 12:05 <DIR> d-------- c:\program files\Common Files\Nero
2008-12-09 12:04 . 2008-12-09 12:04 <DIR> d-------- c:\documents and settings\All Users\Application Data\Nero
2008-12-09 11:45 . 2008-12-09 11:45 <DIR> d-------- c:\windows\'Full Speed' Internet Booster + Performance Tests
2008-12-09 11:45 . 2008-12-09 11:45 <DIR> d-------- c:\program files\'Full Speed' Internet Booster + Performance Tests
2008-12-09 11:44 . 2008-12-09 11:45 <DIR> d-------- C:\aidualc3
2008-12-09 11:37 . 2008-04-14 00:15 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys
2008-12-09 11:37 . 2008-04-14 00:15 32,128 --a--c--- c:\windows\system32\dllcache\usbccgp.sys
2008-12-09 11:36 . 2008-12-09 11:36 <DIR> d-------- c:\program files\BandRich
2008-12-09 11:36 . 2008-03-14 10:31 100,096 --a------ c:\windows\system32\drivers\br3gmdm.sys
2008-12-09 11:35 . 2008-04-14 00:15 26,368 --a--c--- c:\windows\system32\dllcache\usbstor.sys
2008-12-09 11:29 . 2008-12-09 11:36 <DIR> d-------- c:\windows\LastGood
2008-12-09 11:22 . 2008-12-09 11:24 <DIR> d-------- c:\documents and settings\OK450\Contacts
2008-12-09 11:21 . 2007-06-30 22:22 933,888 --a------ c:\windows\system32\xp.ocx
2008-12-09 11:21 . 2007-11-26 00:48 114,688 --a------ c:\windows\system32\BM Radio v2.1.exe
2008-12-09 11:21 . 2007-07-21 03:16 41,008 --a------ c:\windows\system32\DCSysTray.ocx
2008-12-09 11:19 . 2008-12-09 11:19 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2008-12-09 11:18 . 2008-12-09 11:18 <DIR> d-------- c:\program files\Common Files\Adobe
2008-12-09 11:17 . 2008-12-09 11:17 <DIR> d-------- c:\program files\K-Lite Codec Pack
2008-12-09 11:17 . 2008-12-09 11:17 <DIR> d-------- c:\program files\Internet Download Manager
2008-12-09 11:17 . 2008-12-09 11:17 <DIR> d-------- c:\program files\FastStone Capture
2008-12-09 11:17 . 2008-12-09 11:50 <DIR> d-------- c:\documents and settings\OK450\Application Data\IDM
2008-12-09 11:17 . 2008-12-09 18:36 <DIR> d-------- c:\documents and settings\OK450\Application Data\DMCache
2008-12-09 11:16 . 2008-12-09 11:36 <DIR> d----c--- c:\windows\system32\DRVSTORE
2008-12-09 11:16 . 2008-12-09 11:16 <DIR> d-------- c:\program files\Windows Live
2008-12-09 11:16 . 2008-12-09 11:16 <DIR> d-------- c:\program files\ESET
2008-12-09 11:16 . 2008-12-09 11:16 <DIR> d-------- c:\documents and settings\All Users\Application Data\ESET
2008-12-09 11:07 . 2008-12-09 11:07 27,904 --a------ c:\windows\system32\drivers\Ndisprot.sys
2008-12-09 10:26 . 2008-10-24 14:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-12-09 10:24 . 2008-08-14 13:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-12-09 10:24 . 2008-08-14 13:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-12-09 10:24 . 2008-08-14 12:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-12-09 10:24 . 2008-08-14 12:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-12-09 10:22 . 2008-06-13 14:05 272,128 --------- c:\windows\system32\drivers\bthport.sys
2008-12-09 10:22 . 2008-06-13 14:05 272,128 -----c--- c:\windows\system32\dllcache\bthport.sys
2008-12-09 10:17 . 2008-12-09 11:11 <DIR> d--h----- c:\windows\$hf_mig$
2008-12-09 10:17 . 2006-09-06 17:43 22,752 --a------ c:\windows\system32\spupdsvc.exe
2008-12-09 10:16 . 2008-12-09 11:12 <DIR> d-------- c:\windows\nview
2008-12-09 10:16 . 2007-04-19 08:26 208,896 --a------ c:\windows\system32\nvudisp.exe
2008-12-09 10:16 . 2008-12-09 11:24 88,723 --a------ c:\windows\system32\nvapps.xml
2008-12-09 10:16 . 2007-04-19 08:26 17,056 --a------ c:\windows\system32\nvdisp.nvu
2008-12-09 10:15 . 2008-12-09 10:15 <DIR> d--hs---- c:\documents and settings\OK450\UserData
2008-12-09 10:15 . 2007-04-19 14:14 208,896 --a------ c:\windows\system32\NVUNINST.EXE
2008-12-09 10:14 . 2008-12-09 10:14 <DIR> d-------- c:\windows\system32\Lang
2008-12-09 10:14 . 2008-12-09 10:14 940,794 --a------ c:\windows\system32\LoopyMusic.wav
2008-12-09 10:14 . 2008-12-09 10:14 146,650 --a------ c:\windows\system32\BuzzingBee.wav
2008-12-09 10:12 . 2006-08-01 10:02 49,152 -r------- c:\windows\system32\ChCfg.exe
2008-12-09 10:11 . 2008-12-09 10:11 <DIR> d-------- c:\program files\Realtek
2008-12-09 10:11 . 2008-12-09 10:11 <DIR> d--h----- c:\program files\InstallShield Installation Information
2008-12-09 10:11 . 2008-12-09 10:11 <DIR> d-------- c:\documents and settings\OK450\Application Data\InstallShield
2008-12-09 10:10 . 2008-12-09 10:10 <DIR> d-------- c:\program files\Common Files\InstallShield
2008-12-09 10:10 . 2006-09-12 09:34 499,712 -r------- c:\windows\RtlExUpd.dll
2008-12-09 10:09 . 2008-12-09 10:09 <DIR> d-------- c:\program files\Intel
2008-12-09 10:08 . 2008-12-09 10:10 4,716 --a------ c:\windows\gdrv.sys
2008-12-09 10:05 . 2008-12-09 10:05 <DIR> d---s---- c:\windows\system32\Microsoft
2008-12-09 10:05 . 2008-12-09 11:22 <DIR> d-------- c:\documents and settings\OK450
2008-12-09 10:05 . 2008-12-09 10:05 <DIR> d--hs---- c:\documents and settings\LocalService
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-09 03:40 --------- d-----w c:\program files\microsoft frontpage
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-16 11:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 11:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 11:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 11:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 11:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 11:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 11:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 11:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-10 01:14 1,307,648 ----a-w c:\windows\system32\msxml6.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-11-27 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2008-05-05 2594224]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-19 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-04-19 86016]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-08-18 1447168]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"nwiz"="nwiz.exe" [2007-04-19 c:\windows\system32\nwiz.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
R1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2008-08-18 34312]
R2 BandLuxe_Service;BandLuxe Service;"c:\program files\BandRich\BandLuxe HSDPA Utility R11\BRService.exe" -e [2008-04-15 85016]
R2 ekrn;Eset Service;"c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe" [2007-12-21 468224]
R3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\DRIVERS\SkyNET.SYS [2008-09-19 349184]
R3 ZOOM705;Zoom Wireless-G USB 705 driver;c:\windows\system32\DRIVERS\WlanUIG.sys [2008-12-05 358304]
S3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB;c:\windows\system32\DRIVERS\br3gmdm.sys [2008-12-09 100096]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{014fed94-c5cb-11dd-85f5-000dd714c5c4}]
\Shell\AutoRun\command - H:\AUTORUN_BANDLUXE.EXE
*Newly Created Service* - BANDLUXE_SERVICE
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
*Newly Created Service* - USNJSVC
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-12-09 18:36:04
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\msqpdxserv.sys]
"imagepath"="\systemroot\system32\drivers\msqpdxmqltoiqh.sys"
.
Completion time: 2008-12-09 18:36:24
ComboFix-quarantined-files.txt 2008-12-09 15:36:22
Pre-Run: 45,088,464,896 bytes free
Post-Run: 45,642,399,744 bytes free
165
