ComboFix 09-04-04.01 - Administrator 04/07/2009 1:12:00.1 - NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1256.1.1033.18.2295.1040 [GMT 3:00]
Running from: c:\users\Administrator\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\sys\11.exe
c:\windows\sys\9.exe
c:\windows\system32\img_utils.dll
c:\windows\system32\imgscaler.dll
c:\windows\system32\videoformat.dll
c:\windows\system32\viscomaudiodata.dll
c:\windows\system32\viscomflvdec.dll
c:\windows\system32\viscomframe.dll
c:\windows\system32\viscommpgdec.dll
c:\windows\system32\viscomwave.dll
.
((((((((((((((((((((((((( Files Created from 2009-03-06 to 2009-04-06 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-06 22:16 --------- d-----w c:\users\Administrator\AppData\Roaming\DMCache
2009-04-06 22:16 --------- d-----w c:\users\ADMINI~1\AppData\Roaming\DMCache
2009-04-06 21:45 --------- d-----w c:\users\Administrator\AppData\Roaming\Hide IP NG
2009-04-06 21:45 --------- d-----w c:\users\ADMINI~1\AppData\Roaming\Hide IP NG
2009-04-03 22:40 --------- d-----w c:\program files\LeapFTP
2009-04-03 18:20 --------- d--h--w c:\progra~2\CanonBJ
2009-04-02 11:39 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-03-28 19:02 --------- d-----w c:\program files\Zealot Software
2009-03-28 18:32 --------- d-----w c:\progra~2\River Past G5
2009-03-28 18:25 164,784 ----a-w c:\windows\Video Slice Uninstaller.exe
2009-03-28 18:25 --------- d-----w c:\users\Administrator\AppData\Roaming\River Past G5
2009-03-28 18:25 --------- d-----w c:\users\ADMINI~1\AppData\Roaming\River Past G5
2009-03-28 18:25 --------- d-----w c:\program files\WMV9_VCM
2009-03-28 18:25 --------- d-----w c:\program files\River Past
2009-03-28 18:25 --------- d-----w c:\program files\Common Files\River Past
2009-03-26 13:49 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-26 13:49 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-03-26 11:37 --------- d-----w c:\users\Administrator\AppData\Roaming\QuickScan
2009-03-26 11:37 --------- d-----w c:\users\ADMINI~1\AppData\Roaming\QuickScan
2009-03-21 20:39 --------- d-----w c:\program files\
2009-03-21 20:24 --------- d-----w c:\users\Administrator\AppData\Roaming\GPass-3
2009-03-21 20:24 --------- d-----w c:\users\ADMINI~1\AppData\Roaming\GPass-3
2009-03-21 20:23 --------- d-----w c:\users\Administrator\AppData\Roaming\GPass
2009-03-21 20:23 --------- d-----w c:\users\ADMINI~1\AppData\Roaming\GPass
2009-03-16 17:16 --------- d-----w c:\program files\Messenger Plus! Live
2009-03-11 16:21 --------- d-----w c:\program files\torrentsearcher
2009-03-11 11:34 --------- d-----w c:\program files\MessengerDiscovery
2009-03-11 11:26 --------- d-----w c:\users\Administrator\AppData\Roaming\Malwarebytes
2009-03-11 11:26 --------- d-----w c:\users\ADMINI~1\AppData\Roaming\Malwarebytes
2009-03-11 11:25 --------- d-----w c:\progra~2\Malwarebytes
2009-03-09 19:31 --------- d-----w c:\program files\Hotspot Shield
2009-03-06 17:23 --------- d-----w c:\program files\MSN Messenger
2009-03-05 23:06 3,172 ----a-w c:\program files\index.htm
2009-03-05 01:20 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-04 13:10 --------- d-----w c:\program files\BearShare
2009-03-04 09:25 --------- d-----w c:\program files\Enlight
2009-03-04 09:24 --------- d-----w c:\program files\Common Files\InstallShield
2009-02-26 02:02 --------- d-----w c:\progra~2\open beep
2009-02-26 01:53 --------- d-----w c:\program files\Circle Developement
2009-02-23 19:00 --------- d-----w c:\program files\DoremiSoft
2009-02-18 20:36 --------- d-----w c:\users\Administrator\AppData\Roaming\uTorrent
2009-02-18 20:36 --------- d-----w c:\users\ADMINI~1\AppData\Roaming\uTorrent
2009-02-09 16:33 --------- d-----w c:\progra~2\Microsoft Help
2008-01-21 02:41 174 --sha-w c:\program files\desktop.ini
2008-09-06 23:28 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008090620080907\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ea4c6a8d-2565-4f22-bfdf-e41b4754f9e0}]
09/12/2008 07:43 AM 1780248 --a------ c:\program files\torrentsearcher\tbtorr.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
03/09/2009 10:30 PM 204248 --a------ c:\program files\Hotspot Shield\hssie\HssIE.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ea4c6a8d-2565-4f22-bfdf-e41b4754f9e0}"= "c:\program files\torrentsearcher\tbtorr.dll" [09/12/2008 07:43 AM 1780248]
[HKEY_CLASSES_ROOT\clsid\{ea4c6a8d-2565-4f22-bfdf-e41b4754f9e0}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [01/21/2008 05:21 AM 1233920]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [10/18/2007 11:34 AM 5724184]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [01/21/2008 05:23 AM 125952]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [10/24/2008 03:23 PM 880640]
"swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [10/24/2008 01:18 PM 171448]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [01/21/2008 05:23 AM 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [08/24/2007 05:00 PM 33648]
"MsgCenterExe"="c:\program files\Common Files\Real\Update_OB\RealOneMessageCenter.exe" [08/22/2008 01:25 AM 69632]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [08/22/2008 01:25 AM 185896]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [01/19/2005 11:45 AM 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [01/19/2005 11:39 AM 217088]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [06/12/2008 12:38 PM 34672]
"avgnt"="c:\program files\Avira\Avira Premium Security Suite\avgnt.exe" [06/12/2008 02:28 PM 266497]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [03/25/2008 02:28 PM 144784]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [01/12/2006 04:40 PM 155648]
"BearShare"="c:\program files\BearShare\BearShare.exe" [07/26/2006 01:48 PM 3305472]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [06/23/2005 08:33 PM 57344]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [03/26/2009 04:49 PM 401040]
c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-17 113664]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]
c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2008-09-11 11713536]
c:\users\ADMINI~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-17 113664]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1272675348-428297823-745401570-500]
"EnableNotificationsRef"=dword:00000003
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{97FB02E1-1765-4C15-A6E2-FA904A328D30}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{DA7455C5-98D9-4E3A-9BAD-7EE0A942B786}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{856ABC95-5285-47B2-96B8-96E3B33B10AB}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{A77AA9C8-0484-41C2-9CED-1A7FCEF5A21F}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{4360C5BB-125A-46C7-8655-5B3A845AF6C3}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{90C14FA4-4B7B-4FC0-8542-D71A50D243F9}c:\\program files\\common files\\nero\\nero web\\setupx.exe"= UDP:c:\program files\common files\nero\nero web\setupx.exe:Nero Installer
"UDP Query User{74FDE944-C077-41F4-9A88-75C4618CB34F}c:\\program files\\common files\\nero\\nero web\\setupx.exe"= TCP:c:\program files\common files\nero\nero web\setupx.exe:Nero Installer
"{021CA3FF-6C9B-4A6F-872E-CE0FD9DC6E43}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{00ADC815-FDD1-48A0-9340-CCB69E232070}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{64297BDB-C9B3-4625-B7EA-34E49F76F323}c:\\program files\\paltalk messenger\\paltalk.exe"= UDP:c:\program files\paltalk messenger\paltalk.exe
altalkScene
"UDP Query User{2B707DBA-7228-4D5B-928B-45E6D36AF1D3}c:\\program files\\paltalk messenger\\paltalk.exe"= TCP:c:\program files\paltalk messenger\paltalk.exe
altalkScene
"{F90377AA-6274-47C5-9E35-E223CDAE4C79}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\River Past\\Video Slice\\VideoSlice.exe"= c:\program files\River Past\Video Slice\VideoSlice.exe:*:Enabled:River Past Video Slice
R1 avfwot;avfwot;c:\windows\System32\drivers\avfwot.sys [2008-09-25 71592]
R2 AntiVirFirewallService;Avira Premium Security Suite Firewall;c:\program files\Avira\Avira Premium Security Suite\avfwsvc.exe [2008-09-25 344321]
R2 AntiVirMailService;Avira Premium Security Suite MailGuard;c:\program files\Avira\Avira Premium Security Suite\avmailc.exe [2008-09-25 164097]
R2 antivirwebservice;Avira Premium Security Suite WebGuard;c:\program files\Avira\Avira Premium Security Suite\avwebgrd.exe [2008-09-25 258305]
R2 AVEService;Avira Premium Security Suite MailGuard helper service;c:\program files\Avira\Avira Premium Security Suite\avesvc.exe [2008-09-25 41217]
R2 HssSrv;Hotspot Shield Helper Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [2009-02-06 117208]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2009-03-11 179856]
R3 avfwim;AvFw Packet Filter Miniport;c:\windows\System32\drivers\avfwim.sys [2008-09-25 71464]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [2008-01-21 179712]
R3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\System32\drivers\hssdrv.sys [2009-03-09 31704]
R3 MBAMProtector;MBAMProtector;c:\windows\System32\drivers\mbam.sys [2009-03-11 15504]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
%SystemRoot%\system32\soundschemes.exe /AddRegistration
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyServer = socks=
uInternet Settings,ProxyOverride = plimus.com,
,
IE: Download All Links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Zobrazit origin?l - c:\program files\
IE: Zobrazit v?e jako origin?l - c:\program files\
LSP: avsda.dll
FF - ProfilePath - c:\users\ADMINI~1\AppData\Roaming\Mozilla\Firefox\Profiles\lmfue96b.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: network.proxy.socks - 127.0.0.1
FF - prefs.js: network.proxy.socks_port - 7070
FF - prefs.js: network.proxy.type - 4
FF - component: c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\lmfue96b.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\BDQScan.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-07 01:16:21
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'Explorer.exe'(3248)
c:\progra~2\Stardock\XGF\XGFRuntimeServerDll.dll
c:\program files\Common Files\Microsoft Shared\OFFICE11\MSOXEV.DLL
.
Completion time: 04/07/2009 1:19:33
ComboFix-quarantined-files.txt 2009-04-06 22:19:25
ComboFix2.txt 2008-08-25 21:56:31
Pre-Run: 7,141,744,640 bytes free
Post-Run: 7,192,047,616 bytes free
193 --- E O F --- 2008-10-26 11:13:13
.png)
.png)
