ComboFix 08-02-25.3 - Compaq_Owner 2008-02-27 22:02:43.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.123 [GMT 4:00] Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\AutoRun.inf D:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-01-27 to 2008-02-27 ))))))))))))))))))))))))))))))) . 2008-02-27 12:43 . 2008-02-27 12:43 d-------- C:\Program Files\Critec Accounting 2008-02-27 12:43 . 2008-02-27 12:42 276,480 --a------ C:\WINDOWS\system32\ACTBAR.OCX 2008-02-27 12:43 . 2008-02-27 12:42 197,120 --a------ C:\WINDOWS\system32\FormViewer.OCX 2008-02-27 12:43 . 2008-02-27 12:42 196,880 --a------ C:\WINDOWS\system32\RICHTX32.OCX 2008-02-27 12:43 . 2008-02-27 12:42 155,920 --a------ C:\WINDOWS\system32\COMCT232.OCX 2008-02-27 12:43 . 2008-02-27 12:42 134,416 --a------ C:\WINDOWS\system32\MSMAPI32.OCX 2008-02-27 12:42 . 2008-02-27 12:42 71,680 --a------ C:\WINDOWS\ST5UNST.EXE 2008-02-27 12:42 . 2008-02-27 12:42 29,696 --a------ C:\WINDOWS\system32\VB5StKit.dll 2008-02-23 13:00 . 2008-02-23 13:00 d-------- C:\Program Files\Trend Micro 2008-02-22 19:22 . 2005-08-19 16:30 182,871 --a------ C:\visa_form.PDF 2008-02-22 07:52 . 2001-09-07 21:41 180,224 --a------ C:\WINDOWS\system32\mathlib.ocx 2008-02-22 07:52 . 2001-06-20 17:53 32,768 --a------ C:\WINDOWS\system32\mathdll.dll 2008-02-09 14:29 . 2008-02-09 14:29 d-------- C:\Program Files\Common Files\Thomson ResearchSoft . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-27 14:17 --------- d-----w C:\Documents and Settings\Compaq_Owner\Application Data\vmntoolbar 2008-02-27 11:03 --------- d-----w C:\Documents and Settings\Compaq_Owner\Application Data\EndNote 2008-02-26 03:39 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-02-23 04:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7 2008-02-23 04:26 --------- d-----w C:\Documents and Settings\Compaq_Owner\Application Data\AVG7 2008-02-22 03:52 --------- d-----w C:\Program Files\Wildlife Computers 2008-02-10 16:24 --------- d-----w C:\Program Files\Common Files\Adobe 2008-02-09 10:27 --------- d-----w C:\Program Files\EndNote X1 2008-01-26 11:13 --------- d-----w C:\Program Files\BitZipper 2008-01-25 12:39 12,219,983 ------w C:\avg7qt.dat 2008-01-24 19:51 --------- d-----w C:\Documents and Settings\Compaq_Owner\Application Data\BitZipper 2008-01-08 02:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Wildlife Computers 2007-07-15 03:57 104,120 ----a-w C:\Documents and Settings\Compaq_Owner\Application Data\GDIPFONTCACHEV1.DAT 2005-09-23 23:49 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 20:24 1694208] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-02-10 11:33 171448] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00 15360] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472] "LaCie Backup"="C:\Program Files\LaCie\Backup Software\\LaCieBackup.exe" [2006-01-24 09:55 2633728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ftutil2"="ftutil2.dll" [2004-06-07 18:05 106496 C:\WINDOWS\system32\ftutil2.dll] "PCMService"="C:\Program Files\CyberLink\PowerCinema\PCMService.exe" [2006-02-24 22:46 147456] "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 18:14 237568] "PCDrProfiler"="" [] "HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-11-09 21:29 249856] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-21 09:17 579072] "KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 16:44 61440] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-03-18 09:35 98304] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-05-23 00:14 180269] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-06-04 12:38 286720] "DownloadAccelerator"="C:\Program Files\DAP\DAP.exe" [2007-06-06 13:13 4376328] "dvd43"="C:\Program Files\dvd43\dvd43_tray.exe" [2006-05-22 13:26 694272] "Corel Reminder"="" [] "AttuneClientEngine"="C:\PROGRA~1\Aveo\Attune\bin\attune_ce.exe" [2000-07-24 23:47 356728] "Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 02:12 483328] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-22 20:16 219136] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-06-26 13:16:24 25214] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-18 00:05:56 65588] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"= "C:\\Program Files\\CyberLink\\PowerCinema\\PCMService.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\DAP\\DAP.exe"= "C:\\Program Files\\I&M\\MaxSea\\MaxSea.exe"= "C:\\Program Files\\Visicom Media\\AceFTP 3 Freeware\\aceftp3free.exe"= "C:\\Program Files\\Wildlife Computers\\Utilities\\Fast-GPSSolver.exe"= R2 argosfetch;Wildlife Computers Argos Retriever;"C:\Program Files\Wildlife Computers\Utilities\ArgosFetch.exe" [2007-12-12 16:11] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1350db0d-4aca-11dc-9c61-001731abfbe7}] \Shell\Auto\command - RavMon.exe e \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMon.exe e [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d4d6aab-6343-11dc-9c7f-001731abfbe7}] \Shell\AutoRun\command - K:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3803312a-d12b-11db-9b76-001731abfbe7}] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL NetMonster.vbs [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8aed51ee-4006-11dc-9c48-001731abfbe7}] \Shell\AutoRun\command - K:\setupSNK.exe . Contents of the 'Scheduled Tasks' folder "2008-02-26 17:00:00 C:\WINDOWS\Tasks\backup.job" - C:\backup.bat . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-27 22:05:03 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-02-27 22:08:25 ComboFix-quarantined-files.txt 2008-02-27 18:08:22