ComboFix 08-02-23 - Skubr 2008-02-23 12:42:36.1 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.179 [GMT 11:00] Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat C:\Documents and Settings\Skubr\Desktop\Error Cleaner.url C:\Documents and Settings\Skubr\Desktop\Privacy Protector.url C:\Documents and Settings\Skubr\Desktop\Spyware&Malware Protection.url C:\Documents and Settings\Skubr\Favorites\Error Cleaner.url C:\Documents and Settings\Skubr\Favorites\Privacy Protector.url C:\Documents and Settings\Skubr\Favorites\Spyware&Malware Protection.url C:\WINDOWS\search_res.txt C:\WINDOWS\system32\suspend.exe ----- BITS: Possible infected sites ----- hxxp://onsafepro.com hxxp://softworldnetwork.com . ((((((((((((((((((((((((( Files Created from 2008-01-23 to 2008-02-23 ))))))))))))))))))))))))))))))) . 2008-02-23 11:44 . 2008-02-23 11:44 d-------- C:\Program Files\CCleaner 2008-02-21 23:29 . 2008-02-21 23:29 d-------- C:\Documents and Settings\Skubr\Application Data\TrojanHunter 2008-02-21 23:00 . 2008-02-21 23:00 d-------- C:\Program Files\TrojanHunter 5.0 2008-02-21 22:49 . 2008-02-21 22:49 d-------- C:\Program Files\Spybot - Search & Destroy 2008-02-21 22:49 . 2008-02-21 22:49 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-02-21 20:12 . 2008-02-21 20:12 0 --a------ C:\WINDOWS\nsreg.dat 2008-02-21 20:05 . 2008-02-21 20:05 d-------- C:\Program Files\Enigma Software Group 2008-02-18 23:26 . 2008-02-18 23:26 d-------- C:\Program Files\Microsoft Silverlight 2008-02-18 23:21 . 2008-02-18 23:21 d-------- C:\Program Files\Windows Defender 2008-02-16 00:06 . 2008-02-16 00:06 d-------- C:\Documents and Settings\All Users\Application Data\WinZip 2008-02-15 20:28 . 2008-02-15 03:59 274,432 --------- C:\WINDOWS\bdmnopx.dll 2008-02-15 20:28 . 2008-02-15 03:59 270,336 --a------ C:\WINDOWS\admggxp.dll 2008-02-04 17:59 . 2008-02-23 12:45 12 --a------ C:\WINDOWS\bthservsdp.dat 2008-02-04 17:51 . 2008-02-04 17:51 d--hs---- C:\FOUND.004 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-12-19 23:01 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-12-18 09:51 179,584 ------w C:\WINDOWS\system32\dllcache\mrxdav.sys 2007-12-14 23:55 118,784 ------r C:\WINDOWS\bwUnin-7.2.0.157-8876480SL.exe 2007-12-08 05:21 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-12-06 11:01 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2007-12-06 11:00 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-12-06 11:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-12-06 04:59 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll 2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll 2007-12-04 18:38 550,912 ------w C:\WINDOWS\system32\dllcache\oleaut32.dll 2006-10-08 03:53 17 ----a-w C:\Program Files\Sims2Pack Clean Installer.ini 2001-04-03 01:54 36,864 ----a-w C:\WINDOWS\inf\Option.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360] "OM2_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2006-12-01 21:28 95800] "Zinio DLM"="C:\Program Files\Zinio\ZinioReader.exe" [ ] "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-12-15 10:55 36864] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RCMonitor"="C:\Acer\Recovery\RCMonitor.exe" [2004-06-01 16:13 249856] "SoundMan"="SOUNDMAN.EXE" [2004-07-01 11:58 73728 C:\WINDOWS\SOUNDMAN.EXE] "UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ] "pccguide.exe"="D:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe" [2005-09-28 23:07 897086] "Adobe Photo Downloader"="D:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" [2005-09-09 01:18 57344] "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 10:22 155648] "PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 14:25 57393] "IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 14:45 40960] "SetDefPrt"="C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe" [2005-01-26 18:02 49152] "ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2005-07-22 21:36 933888] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-05 18:03 267064] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:56 110592 C:\WINDOWS\system32\bthprops.cpl] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584] "SpyHunter Security Suite"="C:\PROGRAM FILES\ENIGMA SOFTWARE GROUP\SPYHUNTER\SPYHUNTER3.exe" [2008-01-23 14:47 847872] "THGuard"="C:\Program Files\TrojanHunter 5.0\THGuard.exe" [2008-02-08 11:22 1047712] "RegistryMechanic"="" [] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Compaq S200 Button Manager.lnk - C:\Program Files\Compaq S200 Scanner\S200Btns.exe [2006-08-19 12:43:08 430080] Status Monitor.lnk - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2006-10-03 23:34:29 802816] WG111v2 Smart Wizard Wireless Setting.lnk - C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2006-11-23 11:15:37 745472] Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-12-15 10:55:33 196608] WinZip Quick Pick.lnk - D:\Program Files\WinZip\WZQKPICK.EXE [2007-08-03 11:10:00 394856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "admggxp"= {92BFC259-1FE7-4740-BE4A-334DE62EED2D} - C:\WINDOWS\admggxp.dll [2008-02-15 03:59 270336] "bdmnopx"= {EB8C0FE1-22D7-404B-96AA-8008C4C86812} - C:\WINDOWS\bdmnopx.dll [2008-02-15 03:59 274432] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk backup=C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AlarmS4.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AlarmS4.lnk backup=C:\WINDOWS\pss\AlarmS4.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Harmony Remote Software 7.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Harmony Remote Software 7.lnk backup=C:\WINDOWS\pss\Logitech Harmony Remote Software 7.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Skubr^Start Menu^Programs^Startup^Adobe Gamma.lnk] path=C:\Documents and Settings\Skubr\Start Menu\Programs\Startup\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ADMTray.exe] --a------ 2004-06-01 15:15 1340416 C:\Program Files\Acer\Desktop Manager\admtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] --a------ 2004-07-02 19:49 57344 C:\WINDOWS\ALCMTR.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd] --a------ 2004-07-05 18:05 2550272 C:\WINDOWS\ALCWZRD.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AsioReg] --a------ 2004-08-04 00:56 11776 C:\WINDOWS\system32\regsvr32.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] --a------ 2004-09-29 07:15 344064 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 00:56 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper] --a------ 2003-06-20 14:55 24576 C:\WINDOWS\system32\CTHELPER.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut] --------- 2004-03-17 15:10 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] --------- 2004-09-30 16:37 126976 C:\WINDOWS\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] --------- 2004-09-30 16:41 155648 C:\WINDOWS\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2007-09-05 18:03 267064 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MemoryCardManager] C:\Program Files\Lexmark\Lexmark Precision Photo\MemCard.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPS] --a------ 2004-03-04 10:53 372736 C:\ACER\PSM.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando] --a------ 2007-04-04 10:48 3745360 C:\Program Files\Pando Networks\Pando\Pando.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2003-10-21 11:52 40960 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SBDrvDet] --a------ 2002-12-03 18:06 45056 C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2004-11-25 10:23 32881 C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg] --------- 2000-05-11 01:00 90112 C:\WINDOWS\UpdReg.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= %windir%\\system32\\sessmgr.exe:@xpsp2res.dll,-22019 "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\Activision\\Empires Dawn of the Modern World\\Empires_DMW.exe"= "C:\\Program Files\\Telstra\\Cable Login\\bpcable.exe"= "C:\\Program Files\\Telstra\\Cable Login\\bpcService.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= %windir%\\Network Diagnostic\\xpnetdiag.exe:@xpsp3res.dll,-20000 "C:\\Program Files\\Pando Networks\\Pando\\pando.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "D:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "C:\\Program Files\\Motorola\\Software Update\\msu.exe"= "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "d:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"= R2 EAPPkt;Realtek EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys [2005-04-01 11:43] R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys [2004-06-01 15:28] R2 RECOVERYCONFIRMSRV;Recovery Confirm Service;c:\acer\recovery\RCService.exe [2004-06-01 16:06] R3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2004-10-15 12:50] R3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys [2004-09-29 03:24] R3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys [2004-01-10 04:28] R3 PortRW;PortRW;C:\WINDOWS\system32\Drivers\PortRW.sys [2003-08-15 14:57] R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys [2006-03-27 17:53] S3 C4C_BSC2;C4C_BSC2;C:\WINDOWS\system32\DRIVERS\C4C_BSC2.sys [2002-07-08 22:32] S3 n558;N558 Bluetooth USB Filter Driver;C:\WINDOWS\system32\Drivers\n558.sys [2007-08-15 07:27] S3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 08:57] . Contents of the 'Scheduled Tasks' folder "2008-02-01 05:04:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-02-23 01:49:14 C:\WINDOWS\Tasks\MP Scheduled Scan.job" - C:\Program Files\Windows Defender\MpCmdRun.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-23 12:46:32 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\EXPLORER.EXE [6.00.2900.3156] -> C:\WINDOWS\bdmnopx.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\system32\brss01a.exe C:\Program Files\Acer\Desktop Manager\admServ.exe D:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE D:\PROGRA~1\TRENDM~1\INTERN~1\PCCTLCOM.EXE D:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe D:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe D:\PROGRA~1\TRENDM~1\INTERN~1\TMPFW.EXE D:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe . ************************************************************************** . Completion time: 2008-02-23 12:49:36 - machine was rebooted ComboFix-quarantined-files.txt 2008-02-23 01:49:34 . 2008-02-23 01:02:04 --- E O F ---