Sorry it took so long, I just stumbled upon the log and I just remembered.
Combofix.txt:
ComboFix 08-01-04.1 - Connor Adams 2008-01-05 16:18:36.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.641 [GMT -8:00]
Running from: C:\Documents and Settings\Connor Adams\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Connor Adams\Desktop\CFScript.txt
* Created a new restore point
FILE
C:\WINDOWS\aaas.exe
C:\WINDOWS\activat.exe
C:\WINDOWS\activate.exe
C:\WINDOWS\activate2.exe
C:\WINDOWS\activate3.exe
C:\WINDOWS\srvdsgf.exe
C:\WINDOWS\system32\nnnmjjj.Vdll
C:\WINDOWS\system32\pkguard32.exe
C:\WINDOWS\system32\pmnnm.dll
C:\WINDOWS\system32\pmnnm.exe
C:\WINDOWS\system32\pmnnm.Vdll
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\VundoFix Backups
C:\VundoFix Backups\addmorefiles.txt
C:\VundoFix Backups\is.exe.bad
C:\VundoFix Backups\lux.exe.bad
C:\VundoFix Backups\s02.exe.bad
C:\VundoFix Backups\th.exe.bad
C:\VundoFix Backups\th3.exe.bad
C:\WINDOWS\aaas.exe
C:\WINDOWS\activat.exe
C:\WINDOWS\activate.exe
C:\WINDOWS\activate2.exe
C:\WINDOWS\activate3.exe
C:\WINDOWS\srvdsgf.exe
C:\WINDOWS\system32\nnnmjjj.Vdll
C:\WINDOWS\system32\pmnnm.dll
C:\WINDOWS\system32\pmnnm.exe
C:\WINDOWS\system32\pmnnm.Vdll
.
((((((((((((((((((((((((( Files Created from 2007-12-06 to 2008-01-06 )))))))))))))))))))))))))))))))
.
2008-01-04 20:09 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-04 19:06 . 2008-01-04 19:06 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-03 16:06 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-01-03 16:06 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-01-03 16:06 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-01-03 15:57 . 2008-01-03 16:22 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-03 15:52 . 2008-01-03 15:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-28 21:34 . 2007-12-28 21:34 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-28 21:34 . 2007-12-28 21:34 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-25 17:44 . 2007-12-25 17:45 <DIR> d-------- C:\Program Files\Total Video Converter
2007-12-25 17:05 . 2003-06-23 01:44 1,415,680 --a------ C:\WINDOWS\system32\wmv9vcm.dll
2007-12-25 17:05 . 2003-08-29 00:55 423,424 --a------ C:\WINDOWS\system32\WMAVDS32.ax
2007-12-25 17:05 . 2001-05-16 16:54 309,616 --a------ C:\WINDOWS\system32\wmv8dmod.dll
2007-12-25 17:05 . 2001-03-26 03:41 245,760 --a------ C:\WINDOWS\system32\mp4sds32.ax
2007-12-25 17:03 . 2007-12-25 17:03 <DIR> d-------- C:\Program Files\Amadis Software
2007-12-25 16:56 . 2007-12-25 16:56 244 --ah----- C:\sqmnoopt03.sqm
2007-12-25 11:44 . 2003-03-30 20:08 372,736 --a------ C:\WINDOWS\system32\xvid.ax
2007-12-25 11:04 . 2007-12-25 11:04 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2007-12-25 11:04 . 2007-12-25 11:04 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_zumbus_01005.Wdf
2007-12-25 11:02 . 2007-12-27 12:05 <DIR> d-------- C:\Program Files\Zune
2007-12-22 14:58 . 2007-12-22 17:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-22 10:43 . 2007-12-22 10:55 188,416 --a------ C:\WINDOWS\spd.exe
2007-12-12 19:16 . 2007-12-12 19:17 <DIR> d-------- C:\Documents and Settings\Connor Adams\Application Data\UseNeXT
2007-12-12 19:15 . 2007-12-12 19:16 <DIR> d-------- C:\Program Files\UseNeXT
2007-12-12 19:15 . 2007-12-12 19:15 2,175,488 --a------ C:\WINDOWS\system32\usenext_client.exe
2007-12-12 17:38 . 2008-01-03 12:58 <DIR> d-------- C:\Program Files\iTunes
2007-12-12 17:34 . 2007-12-12 17:34 <DIR> d-------- C:\Program Files\Common Files\Apple
2007-12-06 22:36 . 2007-12-06 22:36 <DIR> d-------- C:\Documents and Settings\Connor Adams\Application Data\ImgBurn
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-06 00:12 --------- d-----w C:\Documents and Settings\Connor Adams\Application Data\Launchy
2008-01-05 09:58 --------- d-----w C:\Program Files\Microsoft SQL Server
2008-01-05 03:11 --------- d-----w C:\Program Files\RocketDock
2008-01-04 00:39 --------- d-----w C:\Program Files\MSN Messenger
2008-01-04 00:39 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-01-03 23:54 --------- d-----w C:\Program Files\Windows Live
2007-12-27 20:05 --------- d-----w C:\Program Files\QuickTime
2007-12-27 20:03 --------- d-----w C:\Program Files\DAEMON Tools
2007-12-27 08:15 --------- d-----w C:\Program Files\FlashGet
2007-12-26 18:16 --------- d-----w C:\Program Files\Astonsoft
2007-12-23 21:35 --------- d-----w C:\Documents and Settings\Connor Adams\Application Data\DVD Flick
2007-12-23 20:33 --------- d-----w C:\Documents and Settings\Connor Adams\Application Data\U3
2007-12-23 02:56 --------- d-----w C:\Program Files\Winamp
2007-12-22 08:31 --------- d-----w C:\Program Files\LimeWire
2007-12-17 23:14 --------- d-----w C:\Program Files\Steam
2007-12-13 01:38 --------- d-----w C:\Program Files\iPod
2007-11-30 04:09 --------- d-----w C:\Program Files\Postal2STP
2007-11-28 06:46 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-28 06:44 --------- d-----w C:\Program Files\Blaze Media Pro
2007-11-28 05:56 --------- d-----w C:\Documents and Settings\Connor Adams\Application Data\dvdcss
2007-11-28 01:44 --------- d-----w C:\Documents and Settings\Connor Adams\Application Data\FinalBurner Video DVD
2007-11-17 09:06 --------- d-----w C:\Program Files\DVD Flick
2007-11-17 08:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\{CFAB4006-0AE0-414D-866A-DCB2C46553CF}
2007-11-17 07:55 --------- d-----w C:\Documents and Settings\Connor Adams\Application Data\Thinstall
2007-11-16 17:35 --------- d-----w C:\Documents and Settings\Connor Adams\Application Data\DeepBurner Pro
2007-11-16 07:18 --------- d-----w C:\Documents and Settings\Connor Adams\Application Data\Ahead
2007-11-16 05:51 80,288 ----a-w C:\WINDOWS\system32\ZuneIpTransport.dll
2007-11-16 05:51 72,608 ----a-w C:\WINDOWS\system32\ZuneUsbTransport.dll
2007-11-16 05:51 59,296 ----a-w C:\WINDOWS\system32\ZuneBusEnum.exe
2007-11-16 05:51 45,472 ----a-w C:\WINDOWS\system32\ZuneUsbConnection.dll
2007-11-16 05:51 245,664 ----a-w C:\WINDOWS\system32\ZuneWlanCfgSvc.exe
2007-11-16 05:51 155,552 ----a-w C:\WINDOWS\system32\ZuneMTPZ.dll
2007-11-16 05:38 40,832 ----a-w C:\WINDOWS\system32\drivers\zumbus.sys
2007-11-15 15:26 --------- d-----w C:\Program Files\Apple Software Update
2007-11-15 15:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-12 00:51 --------- d-----w C:\Program Files\Cheat Engine
2007-11-10 18:23 --------- d-s---w C:\Program Files\Xfire
2007-11-10 05:10 --------- d-----w C:\Documents and Settings\Connor Adams\Application Data\Xfire
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-28 01:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-18 21:09 1,419,232 ----a-w C:\WINDOWS\system32\WdfCoInstaller01005.dll
2007-10-18 19:31 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll
2005-11-03 23:29 72,832 ----a-r C:\WINDOWS\inf\CamAvb.sys
2002-12-28 15:34 49,215 ----a-w C:\Program Files\Phone_ Ring.mp3
1998-10-31 00:45 199,680 ----a-w C:\Program Files\a3dapi.dll
2005-07-14 19:31 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll
2005-06-26 22:32 616,448 --sha-r C:\WINDOWS\system32\cygwin1.dll
2005-06-22 05:37 45,568 --sha-r C:\WINDOWS\system32\cygz.dll
.
- Code: Select all
<pre>
----a-w 165,784 2007-12-26 17:21:18 C:\Program Files\DAEMON Tools\daemon .exe
----a-w 949,376 2007-12-26 17:20:59 C:\Program Files\ESET\nod32kui .exe
----a-w 267,048 2007-12-26 17:21:16 C:\Program Files\iTunes\iTunesHelper .exe
----a-w 132,496 2007-12-26 17:21:16 C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
----a-w 5,674,352 2007-12-26 17:22:04 C:\Program Files\MSN Messenger\msnmsgr .exe
----a-w 286,720 2008-01-04 01:54:23 C:\Program Files\QuickTime\QTTask .exe
----a-w 286,720 2008-01-04 01:54:39 C:\Program Files\QuickTime\QTTask .exe
----a-w 630,784 2008-01-04 01:59:53 C:\Program Files\RocketDock\RocketDock .exe
----a-w 630,784 2008-01-04 02:00:07 C:\Program Files\RocketDock\RocketDock .exe
----a-w 1,460,560 2007-12-26 17:21:35 C:\Program Files\Spybot - Search & Destroy\TeaTimer .exe
----a-w 166,304 2007-12-26 17:21:17 C:\Program Files\Zune\ZuneLauncher .exe
----a-w 83,968 2007-12-26 17:21:40 C:\WINDOWS\ffpext\ffpsrv .exe
</pre>
((((((((((((((((((((((((((((( snapshot@2008-01-04_21.43.13.29 )))))))))))))))))))))))))))))))))))))))))
.
- 2006-08-05 20:13:24 387,800 ----a-w C:\WINDOWS\assembly\GAC_32\Microsoft.SqlServer.BatchParser\9.0.242.0__89845dcd8080cc91\microsoft.sqlserver.batchparser.dll
+ 2008-01-05 09:53:34 363,376 ----a-w C:\WINDOWS\assembly\GAC_32\Microsoft.SqlServer.BatchParser\9.0.242.0__89845dcd8080cc91\microsoft.sqlserver.batchparser.dll
- 2006-08-05 20:13:24 75,480 ----a-w C:\WINDOWS\assembly\GAC_32\Microsoft.SqlServer.MgdSqlDumper\9.0.242.0__89845dcd8080cc91\microsoft.sqlserver.mgdsqldumper.dll
+ 2008-01-05 09:53:34 78,192 ----a-w C:\WINDOWS\assembly\GAC_32\Microsoft.SqlServer.MgdSqlDumper\9.0.242.0__89845dcd8080cc91\microsoft.sqlserver.mgdsqldumper.dll
- 2006-08-05 20:13:38 1,607,896 ----a-w C:\WINDOWS\assembly\GAC_32\Microsoft.SqlServer.Replication\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.Replication.dll
+ 2008-01-05 09:53:48 1,626,480 ----a-w C:\WINDOWS\assembly\GAC_32\Microsoft.SqlServer.Replication\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.Replication.dll
- 2006-08-05 20:13:26 539,352 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.AnalysisServices.AdomdClient\9.0.242.0__89845dcd8080cc91\Microsoft.AnalysisServices.AdomdClient.dll
+ 2008-01-05 09:53:36 546,160 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.AnalysisServices.AdomdClient\9.0.242.0__89845dcd8080cc91\Microsoft.AnalysisServices.AdomdClient.dll
- 2006-08-05 20:13:24 137,944 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.AnalysisServices.DeploymentEngine\9.0.242.0__89845dcd8080cc91\Microsoft.AnalysisServices.DeploymentEngine.dll
+ 2008-01-05 09:53:34 140,656 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.AnalysisServices.DeploymentEngine\9.0.242.0__89845dcd8080cc91\Microsoft.AnalysisServices.DeploymentEngine.dll
- 2006-08-05 20:13:24 1,211,096 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.AnalysisServices\9.0.242.0__89845dcd8080cc91\Microsoft.AnalysisServices.DLL
+ 2008-01-05 09:53:34 1,217,904 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.AnalysisServices\9.0.242.0__89845dcd8080cc91\Microsoft.AnalysisServices.DLL
- 2006-08-05 20:13:24 35,544 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.DataWarehouse.Interfaces\9.0.242.0__89845dcd8080cc91\Microsoft.DataWarehouse.Interfaces.DLL
+ 2008-01-05 09:53:34 38,256 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.DataWarehouse.Interfaces\9.0.242.0__89845dcd8080cc91\Microsoft.DataWarehouse.Interfaces.DLL
- 2006-08-05 20:11:57 133,848 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.NetEnterpriseServers.ExceptionMessageBox\9.0.242.0__89845dcd8080cc91\Microsoft.NetEnterpriseServers.ExceptionMessageBox.dll
+ 2008-01-05 09:51:54 136,560 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.NetEnterpriseServers.ExceptionMessageBox\9.0.242.0__89845dcd8080cc91\Microsoft.NetEnterpriseServers.ExceptionMessageBox.dll
- 2006-08-05 20:13:23 150,232 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.ConnectionInfo\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.ConnectionInfo.dll
+ 2008-01-05 09:53:34 157,040 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.ConnectionInfo\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.ConnectionInfo.dll
- 2006-08-05 20:11:58 43,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.CustomControls\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.CustomControls.dll
+ 2008-01-05 09:51:54 46,448 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.CustomControls\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.CustomControls.dll
- 2006-08-05 20:11:58 199,384 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.GridControl\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.GridControl.dll
+ 2008-01-05 09:51:54 202,096 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.GridControl\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.GridControl.dll
- 2006-08-05 20:13:24 68,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.RegSvrEnum\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.RegSvrEnum.dll
+ 2008-01-05 09:53:34 71,024 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.RegSvrEnum\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.RegSvrEnum.dll
- 2006-08-05 20:13:24 555,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.Rmo\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.Rmo.dll
+ 2008-01-05 09:53:34 558,448 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.Rmo\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.Rmo.dll
- 2006-08-05 20:13:24 39,640 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.ServiceBrokerEnum\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.ServiceBrokerEnum.dll
+ 2008-01-05 09:53:34 42,352 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.ServiceBrokerEnum\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.ServiceBrokerEnum.dll
- 2006-08-05 20:13:23 1,559,256 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.Smo\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.Smo.dll
+ 2008-01-05 09:53:33 1,598,832 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.Smo\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.Smo.dll
- 2006-08-05 20:13:23 223,960 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.SmoEnum\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.SmoEnum.dll
+ 2008-01-05 09:53:33 222,576 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.SmoEnum\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.SmoEnum.dll
- 2006-08-05 20:13:23 895,704 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.SqlEnum\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.SqlEnum.dll
+ 2008-01-05 09:53:34 906,608 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.SqlEnum\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.SqlEnum.dll
- 2006-08-05 20:11:57 592,600 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.WizardFrameworkLite\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.WizardFrameworkLite.dll
+ 2008-01-05 09:51:54 595,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.WizardFrameworkLite\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.WizardFrameworkLite.dll
- 2006-08-05 20:13:23 43,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.WmiEnum\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.WmiEnum.dll
+ 2008-01-05 09:53:34 46,448 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.SqlServer.WmiEnum\9.0.242.0__89845dcd8080cc91\Microsoft.SqlServer.WmiEnum.dll
+ 2008-01-05 18:32:42 249,856 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.NetEnterp#\a098a7a77ae8276a19c0982876ba70c8\Microsoft.NetEnterpriseServers.ExceptionMessageBox.ni.dll
+ 2008-01-05 18:32:46 90,112 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\2222b4e5740c814861603eee5879fda4\Microsoft.SqlServer.CustomControls.ni.dll
+ 2008-01-05 18:33:04 1,028,096 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\ca874500a43a595f9e60d4eb45e18e72\Microsoft.SqlServer.WizardFrameworkLite.ni.dll
+ 2008-01-05 18:32:52 561,152 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\d46a07c3c416719efe51faa79d2bfad3\Microsoft.SqlServer.GridControl.ni.dll
- 2007-11-07 00:54:58 77,114 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-01-05 09:54:10 77,114 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-07 00:54:58 440,676 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-01-05 09:54:10 440,676 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2005-10-14 10:51:01 66,264 ----a-w C:\WINDOWS\system32\sqlctr90.dll
+ 2007-02-10 13:29:52 67,952 ----a-w C:\WINDOWS\system32\sqlctr90.dll
- 2005-10-14 10:51:26 2,208,016 ----a-w C:\WINDOWS\system32\sqlncli.dll
+ 2007-02-10 13:29:52 2,234,224 ----a-w C:\WINDOWS\system32\sqlncli.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-12-26 09:21 152872]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [ ]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2008-01-04 19:35 630784]
"Aim6"="" []
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2008-01-04 19:35 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 23:43 8466432]
"nwiz"="nwiz.exe" [2007-06-28 23:43 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-28 23:43 81920]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-27 17:17 443968]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-01-04 19:35 36040]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-03 21:56 53760 C:\WINDOWS\system32\narrator.exe]
C:\Documents and Settings\Connor Adams\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-09-09 00:12:44]
Hare.lnk - C:\Program Files\Dachshund Software\Hare\Hare.exe [2002-09-21 11:26:40]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Launchy.lnk - C:\Program Files\Launchy\Launchy.exe [2007-08-12 15:49:26]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableLockWorkstation"= 00000000
"DisableChangePassword"= 00000000
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogoff"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll 2007-03-13 09:57 221184 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FDCDNT.SYS]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FileAndFolderProtector_S]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2007-05-10 21:46 624248 --a------ C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-05-11 02:06 40048 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
C:\Program Files\BitTorrent\bittorrent.exe --force_start_minimized
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\MSN Messenger\MsnMsgr.Exe /background
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files\Steam\Steam.exe -silent
R0 Fasttrak;Fasttrak;C:\WINDOWS\system32\drivers\Fasttrak.sys [2003-04-23 10:23]
R0 viamraid;viamraid;C:\WINDOWS\system32\drivers\viamraid.sys [2005-04-26 08:22]
R1 FDCDNT;FDCDNT;C:\WINDOWS\system32\drivers\FDCDNT.SYS [2007-01-27 18:27]
R2 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [2007-02-10 05:29]
R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2007-11-15 21:38]
R2 ZuneBusEnum;Zune Bus Enumerator;C:\WINDOWS\system32\ZuneBusEnum.exe [2007-11-15 21:51]
S3 CamAv;SAMSUNG Video Capture;C:\WINDOWS\system32\Drivers\CamAv.sys [2005-12-16 00:53]
S3 CAMFLT;%CAMFLT.SvcDesc%;C:\WINDOWS\system32\drivers\CAMFLT.sys [2005-07-19 16:23]
S3 JL2005;JL2005A Toy Camera;C:\WINDOWS\system32\Drivers\toywdm.sys [2005-05-09 19:22]
S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service;C:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2007-11-15 21:51]
S4 aac;aac;C:\WINDOWS\system32\drivers\aac.sys [2003-12-15 21:01]
S4 aarsi3x;aarsi3x;C:\WINDOWS\system32\drivers\aarsi3x.sys [2004-11-11 17:09]
S4 hpt374;hpt374;C:\WINDOWS\system32\drivers\hpt374.sys [2003-11-12 15:33]
S4 hpt3xx;hpt3xx;C:\WINDOWS\system32\drivers\hpt3xx.sys [2004-01-05 06:10]
S4 hptpro;hptpro;C:\WINDOWS\system32\drivers\hptpro.sys [2003-01-27 12:12]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7fe12fa2-0d50-11dc-b759-00142aecaacb}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a397a9f9-8f2a-11da-abaf-806d6172696f}]
\Shell\AutoRun\command - D:\Programs\nu2menu\nu2menu.exe
.
Contents of the 'Scheduled Tasks' folder
"2007-12-29 17:17:42 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-01-05 16:25:38
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-05 16:26:28
ComboFix-quarantined-files.txt 2008-01-06 00:26:08
ComboFix2.txt 2008-01-05 05:43:38
.
2008-01-05 09:59:30 --- E O F ---
New HJT logLogfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 2:29:12 PM, on 1/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Launchy\Launchy.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\Integrator.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\msvs.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Documents and Settings\Connor Adams\Desktop\HiJackThis_v2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Hare.lnk = C:\Program Files\Dachshund Software\Hare\Hare.exe
O4 - Global Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Append to existing PDF -
res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF -
res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF -
res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF -
res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF -
res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF -
res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF -
res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF -
res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) -
http://gamedownload.ijjimax.com/gamedow ... in9USA.cabO22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
--
End of file - 8930 bytes