ComboFix 07-12-18.1 - Owner 2007-12-18 12:43:46.1 -
FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.655 [GMT -8:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\RECYCLER\svchost.exe
.
((((((((((((((((((((((((( Files Created from 2007-11-18 to 2007-12-18 )))))))))))))))))))))))))))))))
.
2007-12-17 19:52 . 2007-12-17 19:52 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-17 16:47 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-12-17 16:47 . 2007-12-13 19:40 77,824 --a------ C:\WINDOWS\system32\IEDFix.exe
2007-12-17 16:47 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-12-17 16:47 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-12-12 03:01 . 2007-12-12 03:03 1,393 --a------ C:\WINDOWS\imsins.BAK
2007-12-11 10:44 . 2007-12-11 10:44 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\AVG7
2007-12-11 10:43 . 2007-12-11 10:43 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2007-12-11 00:36 . 2007-12-11 00:37 <DIR> d-------- C:\Program Files\TrojanHunter 5.0
2007-12-10 17:17 . 2007-12-10 17:17 0 --a------ C:\WINDOWS\VPC32.INI
2007-12-10 17:15 . 2007-12-10 17:16 <DIR> d-------- C:\VirDefs
2007-12-10 17:15 . 2007-12-10 17:16 <DIR> d-------- C:\Support
2007-12-10 17:15 . 2007-12-10 17:16 <DIR> d-------- C:\SevInst
2007-12-10 17:15 . 2007-12-10 17:16 <DIR> d-------- C:\LiveUpdt
2007-12-10 16:21 . 2007-12-10 16:21 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Grisoft
2007-12-10 16:21 . 2007-05-30 04:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-12-01 01:35 . 2007-12-01 01:35 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2007-12-01 01:30 . 2007-12-01 01:30 <DIR> d-------- C:\Program Files\Windows Live Favorites
2007-11-27 09:35 . 2007-11-27 09:35 268 --ah----- C:\sqmdata00.sqm
2007-11-27 09:35 . 2007-11-27 09:35 244 --ah----- C:\sqmnoopt00.sqm
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-18 05:02 32 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-12-18 05:02 32 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-04 06:55 --------- d-----w C:\Documents and Settings\Owner\Application Data\Template
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-28 01:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-26 05:05 --------- d-----w C:\Program Files\MSECache
2007-07-08 19:29 476 ----a-w C:\Documents and Settings\Owner\fix.reg
2006-02-20 05:08 133,184 ----a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT
2005-07-05 03:07 1,127 ---ha-w C:\Documents and Settings\Owner\hpothb07.dat
2004-11-27 02:13 0 ----a-w C:\Documents and Settings\Owner\helpctr.exe
2004-11-15 14:49 0 ----a-w C:\Documents and Settings\Owner\AHQRun.exe
2004-11-13 19:24 0 ----a-w C:\Documents and Settings\Owner\wordpad.exe
2004-11-06 17:24 0 ----a-w C:\Documents and Settings\Owner\LUALL.EXE
2004-06-17 21:11 0 ---ha-w C:\Documents and Settings\Administrator.WINXP\hpothb07.dat
2004-02-16 21:33 32 --sha-w C:\WINDOWS\{5F41BF7F-B338-4092-B2E9-D59341FC19C0}.dat
2005-05-02 18:54 32 --sha-w C:\WINDOWS\{2BD1D6C3-6CE9-4403-890C-C26627F02EE2}.dat
2004-02-16 21:33 32 --sha-w C:\WINDOWS\system32\{3CEF63C7-981F-4214-936F-5CCA2668D5F5}.dat
2005-05-02 18:54 32 --sha-w C:\WINDOWS\system32\{4862B158-E9AE-43CC-9046-700264B6681B}.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2005-07-20 21:07 C:\WINDOWS\system32\nwiz.exe]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 01:25]
"vptray"="C:\PROGRA~1\SYMANT~2\SYMANT~1\vptray.exe" [2003-10-07 12:39]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsMenu"= 0 (0x0)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-10 19:51 39792 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
R1 ANVIOCTL;ANVIOCTL;C:\WINDOWS\system32\DRIVERS\anvioctl.sys [2002-09-18 18:35]
R1 ANVOSDNT;ASUS Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\anvosdnt.sys [2003-03-11 01:44]
R1 BCSWAP;BCSWAP;C:\WINDOWS\system32\drivers\BCSWAP.sys [2002-09-10 23:09]
S2 EvenSystems;EvenSystems;c:\Recycler\svchost.exe []
S3 WBMS;Winbond Memory Stick Storage (MS) Device Driver;C:\WINDOWS\system32\Drivers\WBMS.SYS [2002-02-28 19:20]
.
Contents of the 'Scheduled Tasks' folder
"2007-02-12 18:43:04 C:\WINDOWS\Tasks\XoftSpy.job"
- C:\Program Files\XoftSpy\XoftSpy.exe
"2007-12-07 05:09:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-11 18:35:14 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
"2007-12-18 20:56:22 C:\WINDOWS\Tasks\XoftSpySE 2.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
"2007-12-18 20:05:02 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************
catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2007-12-18 12:55:11
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\SYSTEM32\winlogon.exe
-> C:\WINDOWS\system32\NavLogon.dll
.
Completion time: 2007-12-18 12:57:26 - machine was rebooted
C:\ComboFix2.txt ... 2007-07-22 17:09
C:\ComboFix3.txt ... 2007-07-18 11:46
.
2007-12-12 11:04:46 --- E O F ---