ComboFix 09-07-14.08 - bsa 10/16/2009 22:05.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.446.224 [GMT 2:00]
Running from: c:\documents and settings\bsa\My Documents\Downloads\Programs\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
E:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_AVPsys
((((((((((((((((((((((((( Files Created from 2009-09-16 to 2009-10-16 )))))))))))))))))))))))))))))))
.
2009-10-14 23:43 . 2003-02-05 19:06 45142 ----a-w- c:\windows\system32\PXC25s.dll
2009-10-14 23:43 . 2002-12-27 17:33 20569 ----a-w- c:\windows\system32\PXC25pm.dll
2009-10-14 23:43 . 2003-11-15 20:27 118872 ----a-w- c:\windows\system32\PXC25uis.dll
2009-10-14 23:43 . 2003-09-15 01:36 390656 ----a-w- c:\windows\system32\pdfxclib.dll
2009-10-14 23:43 . 2003-08-15 22:15 109568 ----a-w- c:\windows\system32\pdfxcpro.dll
2009-10-14 23:43 . 2003-08-15 22:12 144896 ----a-w- c:\windows\system32\xc_parse.dll
2009-10-14 23:43 . 2003-07-31 17:02 8704 ----a-w- c:\windows\system32\pdfxcds.dll
2009-10-14 23:43 . 2003-05-18 17:37 157184 ----a-w- c:\windows\system32\img_xchg.dll
2009-10-14 23:43 . 2003-04-13 23:08 185344 ----a-w- c:\windows\system32\Img_cdx.dll
2009-10-14 23:43 . 2002-01-05 05:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2009-10-14 23:43 . 2009-10-14 23:43 -------- d-----w- c:\program files\TTMessenger
2009-10-14 23:09 . 2009-10-14 23:09 -------- d-----w- c:\program files\Trend Micro
2009-10-13 19:20 . 2009-10-13 19:20 -------- d-----w- c:\documents and settings\bsa\Local Settings\Application Data\Adobe
2009-10-13 01:21 . 2009-03-24 14:08 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-10-13 01:21 . 2009-10-14 17:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-10-12 15:29 . 2008-02-07 15:10 -------- d--h--w- C:\ckis
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-16 20:08 . 2009-07-06 18:50 -------- d-----w- c:\documents and settings\bsa\Application Data\DMCache
2009-10-14 18:21 . 2009-07-11 17:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2006-02-28 15360]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-01-23 2745776]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1667584]
"TTMessengerPDF"="c:\program files\TTMessenger\spool\PDFSaver.exe" [2004-03-22 61440]
"TTMessenger"="c:\program files\TTMessenger\ttmessenger2.exe" [2008-01-22 585728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-05 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-02-28 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.323\\English\\setup.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\English\\setup.exe"=
"c:\\Program Files\\TTMessenger\\ttmessenger2.exe"=
R3 PAC207;SoC PC-Camera Beta3;c:\windows\system32\drivers\pfc027.sys [7/9/2009 9:24 PM 162176]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-Messenger (Yahoo!) - e:\program\New Folder (2)\Messenger\YahooMessenger.exe
.
------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = about:blank
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
LSP: c:\windows\system32\idmmbc.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-10-16 22:08
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):49,bc,d1,3f,10,10,f2,dc,f7,39,8c,90,01,f6,4e,b2,ca,1d,c4,3d,a2,
49,6b,5b,f8,b0,cb,49,3f,1c,a3,28,d0,a8,8c,11,42,1a,9e,60,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{d057e77e-d53e-41d6-b345-9fd278f2c288}]
@Denied: (Full) (Everyone)
"Model"=dword:0000011c
"Therad"=dword:00000001
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,98,07,ff,fc,5d,
df,1c,2f,3b,8a,0a,32,11,89,01,b5,78,8f,6f,24,e7,e6,b0,ec,df,80,0f,50,de,68,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(520)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'lsass.exe'(576)
c:\windows\system32\idmmbc.dll
- - - - - - - > 'explorer.exe'(2160)
c:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\PAStiSvc.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\devldr32.exe
.
**************************************************************************
.
Completion time: 2009-10-16 22:09 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-16 20:09
Pre-Run: 37,797,076,992 bytes free
Post-Run: 38,141,698,048 bytes free
121
