ComboFix 08-03-04.5 - The Nays 2008-03-04 18:06:22.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2439 [GMT -7:00] Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\The Nays\Application Data\urlredir.cfg C:\RECYCLER\desktopA.sys . ((((((((((((((((((((((((( Files Created from 2008-02-05 to 2008-03-05 ))))))))))))))))))))))))))))))) . 2008-03-03 20:43 . 2008-03-03 20:43 d-------- C:\WINDOWS\Sun 2008-03-03 18:32 . 2008-03-03 18:32 0 --a------ C:\WINDOWS\vpc32.INI 2008-03-03 17:49 . 2008-03-03 17:49 d-------- C:\Program Files\CCleaner 2008-03-03 04:46 . 2008-03-03 04:46 d-------- C:\Documents and Settings\The Nays\Application Data\Grisoft 2008-03-03 04:45 . 2008-03-03 04:45 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft 2008-03-03 04:45 . 2007-05-30 05:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-03-02 19:47 . 2008-03-02 19:47 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2008-03-02 16:34 . 2008-03-02 16:34 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com 2008-03-02 16:33 . 2008-03-02 16:33 d-------- C:\Program Files\SUPERAntiSpyware 2008-03-02 16:33 . 2008-03-02 16:33 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-03-02 16:33 . 2008-03-02 16:33 d-------- C:\Documents and Settings\The Nays\Application Data\SUPERAntiSpyware.com 2008-03-02 10:05 . 2008-03-02 10:05 d-------- C:\Program Files\Trend Micro 2008-03-02 06:30 . 2008-03-02 06:35 2,202 --a------ C:\WINDOWS\system32\tmp.reg 2008-03-02 06:27 . 2008-03-03 17:34 0 --a------ C:\WINDOWS\win.ini 2008-03-02 06:10 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-03-02 06:10 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-03-02 06:10 . 2008-03-01 23:12 86,016 --a------ C:\WINDOWS\system32\VACFix.exe 2008-03-02 06:10 . 2008-02-29 23:48 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-03-02 06:10 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-03-02 06:10 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-03-02 06:10 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-03-01 14:35 . 2008-03-01 14:35 d---s---- C:\WINDOWS\Downloaded Program Files 2008-02-23 10:24 . 2006-02-28 05:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-02-23 10:17 . 2008-02-23 10:17 d-------- C:\Program Files\Java 2008-02-23 10:17 . 2008-03-03 17:37 d-------- C:\Documents and Settings\The Nays\Application Data\LimeWire 2008-02-23 10:17 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-02-23 10:16 . 2008-02-23 10:17 d-------- C:\Program Files\LimeWire 2008-02-23 10:16 . 2008-02-23 10:16 d-------- C:\Program Files\Common Files\Java 2008-02-20 04:22 . 2008-02-20 04:22 d-------- C:\Program Files\Spybot - Search & Destroy 2008-02-20 04:22 . 2008-02-20 16:14 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy 2008-02-19 01:00 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-02-19 01:00 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-02-18 19:58 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-02-18 16:00 . 2008-02-18 16:00 759 --a------ C:\WINDOWS\system32\spupdsvc.inf 2008-02-18 15:19 . 2008-02-18 15:19 d-------- C:\Program Files\MSXML 4.0 2008-02-18 14:37 . 2008-02-18 14:37 d-------- C:\Program Files\directx 2008-02-18 14:37 . 1998-09-02 01:02 194,320 --a------ C:\WINDOWS\system32\qcut.dll 2008-02-18 14:37 . 1998-08-26 21:51 182,032 --a------ C:\WINDOWS\system32\dxtmsft3.dll 2008-02-18 14:37 . 1998-08-20 04:02 140,800 --a------ C:\WINDOWS\system32\tm20dec.ax 2008-02-18 14:37 . 1998-09-02 01:28 63,488 --a------ C:\WINDOWS\system32\unam4ie.exe 2008-02-18 14:37 . 1998-09-02 01:28 38,160 --a------ C:\WINDOWS\system32\LMRTREND.dll 2008-02-18 14:37 . 1998-08-17 02:21 11,776 --a------ C:\WINDOWS\system32\mciqtz.drv 2008-02-18 14:37 . 1998-08-17 02:21 10,240 --a------ C:\WINDOWS\system32\vidx16.dll 2008-02-18 14:37 . 1998-08-17 02:21 5,672 --a------ C:\WINDOWS\system32\quartz.vxd 2008-02-18 14:37 . 2008-02-18 14:37 4,608 --a------ C:\WINDOWS\system32\w95inf32.dll 2008-02-18 14:37 . 2008-02-18 14:37 2,272 --a------ C:\WINDOWS\system32\w95inf16.dll 2008-02-17 10:24 . 2008-02-17 10:24 d-------- C:\Program Files\NVIDIA nTune Performance Application 2008-02-17 09:46 . 2008-02-17 09:46 d-------- C:\Program Files\3B Software 2008-02-14 07:45 . 2008-02-14 07:45 d-------- C:\Program Files\Logitech 2008-02-14 07:45 . 2008-02-14 07:45 d-------- C:\Program Files\Common Files\Logitech 2008-02-13 14:41 . 2006-07-01 22:39 36,864 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys 2008-02-13 13:48 . 2008-02-23 17:21 d-------- C:\Program Files\Microsoft Games 2008-02-13 13:48 . 2008-02-13 13:48 d-------- C:\Program Files\Disney 2008-02-12 23:07 . 2008-02-12 23:15 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft 2008-02-12 12:58 . 2008-02-12 12:58 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\nView_Profiles 2008-02-12 09:49 . 2008-02-12 09:49 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll 2008-02-12 09:38 . 2008-02-12 09:54 584 --a------ C:\WINDOWS\system32\settingsbkup.sfm 2008-02-12 09:38 . 2008-02-12 09:54 584 --a------ C:\WINDOWS\system32\settings.sfm 2008-02-12 09:36 . 2003-06-12 23:25 7,062 --a------ C:\WINDOWS\system32\audiopid.vxd 2008-02-12 09:35 . 2000-05-21 17:58 647,872 --------- C:\WINDOWS\system32\Mscomct2.ocx 2008-02-12 09:34 . 2005-06-27 03:37 133,632 --a------ C:\WINDOWS\system32\CtDvInst.dll 2008-02-12 09:34 . 2007-06-06 09:40 5,663 --a------ C:\WINDOWS\system32\Ludap17.ini 2008-02-12 09:34 . 2007-05-23 09:53 75 --a------ C:\WINDOWS\system32\ctzapxx.ini 2008-02-12 09:19 . 2006-12-18 16:34 446,464 --a------ C:\WINDOWS\system32\CapabilityTable.exe 2008-02-12 09:19 . 2006-12-18 16:33 356,352 --a------ C:\WINDOWS\system32\nvunrm.exe 2008-02-12 09:19 . 2006-02-17 11:28 101,632 --a------ C:\WINDOWS\system32\drivers\nvtcp.sys 2008-02-12 09:19 . 2005-12-08 12:06 3,657 --a------ C:\WINDOWS\system32\nvnrm.nvu 2008-02-12 09:15 . 2008-02-12 09:15 d-------- C:\Documents and Settings\The Nays\Application Data\InstallShield 2008-02-12 09:15 . 2007-12-10 14:24 159,458 --a------ C:\WINDOWS\system32\nvapps.nvb 2008-02-12 08:53 . 2006-01-31 13:29 107,696 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-02-12 08:53 . 2006-01-31 13:29 87,808 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2008-02-12 08:52 . 2008-02-12 08:53 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec 2008-02-12 08:47 . 2007-12-05 01:41 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe 2008-02-12 08:47 . 2008-02-12 09:15 165,473 --a------ C:\WINDOWS\system32\nvapps.xml 2008-02-12 08:47 . 2007-12-05 01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu 2008-02-12 08:46 . 2008-02-12 08:46 13,690 --a------ C:\WINDOWS\system32\wpa.bak 2008-02-12 08:39 . 2001-09-11 15:20 1,285,632 --------- C:\WINDOWS\system32\SMMedia.dll 2008-02-12 08:39 . 2001-09-18 22:47 765,952 -ra------ C:\WINDOWS\system\crlds3d.dll 2008-02-12 08:39 . 2005-08-10 22:49 393,088 -ra------ C:\WINDOWS\system32\drivers\senfilt.sys 2008-02-12 08:39 . 2005-10-05 02:21 141,312 -ra------ C:\WINDOWS\system32\drivers\ADIHdAud.sys 2008-02-12 08:39 . 2005-03-04 05:53 127,872 -ra------ C:\WINDOWS\system32\drivers\aeaudio.sys 2008-02-12 08:39 . 2005-05-04 09:20 53,248 --------- C:\WINDOWS\system32\wdmioctl.dll 2008-02-12 08:39 . 2005-09-26 16:20 49,152 --a------ C:\WINDOWS\system32\DSndUp.exe 2008-02-12 08:39 . 2002-04-17 15:05 45,056 --------- C:\WINDOWS\system32\CleanUp.exe 2008-02-12 08:39 . 2005-06-21 19:11 23,552 -ra------ C:\WINDOWS\system32\PostProc.dll 2008-02-12 08:37 . 2006-09-06 17:43 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-02-12 08:36 . 2007-11-06 18:59 356,352 --------- C:\WINDOWS\system32\nvuide.exe 2008-02-12 08:36 . 2006-04-24 17:52 289,792 --a------ C:\WINDOWS\system32\idecoiins.dll 2008-02-12 08:36 . 2006-04-24 17:52 289,792 --a------ C:\WINDOWS\system32\idecoi.dll 2008-02-12 08:36 . 2006-04-24 17:52 100,736 --a------ C:\WINDOWS\system32\drivers\nvata.sys 2008-02-12 08:36 . 2006-04-14 14:01 35,840 --a------ C:\WINDOWS\system32\NVCOI.DLL 2008-02-12 08:36 . 2006-02-20 13:00 1,570 --------- C:\WINDOWS\system32\nvide.nvu 2008-02-12 08:08 . 2006-02-28 05:00 571,392 --a--c--- C:\WINDOWS\system32\dllcache\tintlgnt.ime 2008-02-12 08:07 . 2006-02-28 05:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll 2008-02-12 08:06 . 2004-05-13 00:39 876,653 --a--c--- C:\WINDOWS\system32\dllcache\fp4awel.dll 2008-02-12 08:05 . 2008-02-12 09:35 d--hs---- C:\Documents and Settings\All Users.WINDOWS\DRM 2008-02-12 08:05 . 2008-02-12 08:05 749 -rah----- C:\WINDOWS\WindowsShell.Manifest 2008-02-12 08:05 . 2008-02-12 08:05 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest 2008-02-12 08:05 . 2008-02-12 08:05 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest 2008-02-12 08:05 . 2008-02-12 08:05 749 -rah----- C:\WINDOWS\system32\nwc.cpl.manifest . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-05 00:41 --------- d-----w C:\Program Files\Symantec AntiVirus 2008-02-29 00:28 --------- d-----w C:\Program Files\Creative 2008-02-19 00:06 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-12 16:49 114,688 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2008-02-12 15:53 --------- d-----w C:\Program Files\Symantec 2008-02-06 11:40 --------- d-----w C:\Program Files\NVIDIA Corporation 2008-02-01 02:23 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-02-01 02:23 --------- d-----w C:\Program Files\Windows Live 2008-01-25 22:40 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-01-15 21:13 --------- d-----w C:\Program Files\DIFX 2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\wininet.dll 2007-12-05 09:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE 2007-11-04 17:04 5,791 ----a-w C:\Program Files\install.log . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24 1694208] "NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 19:25 81920] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 05:00 15360] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 15:21 61952 C:\WINDOWS\system32\HdAShCut.exe] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-19 18:11 925696] "SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2005-09-07 15:35 716800] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-07 13:02 53408] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-03-17 06:34 124656] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] "nTrayFw"="C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nTrayFw.exe" [2006-02-17 10:40 270336] "CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 10:51 57344] "P17Helper"="P17.dll" [2005-05-03 19:38 64512 C:\WINDOWS\system32\P17.DLL] "Start WingMan Profiler"="C:\Program Files\Logitech\Gaming Software\LWEMon.exe" [2007-09-25 15:03 93208] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312] C:\Documents and Settings\The Nays\Start Menu\Programs\Startup\ LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2008-02-08 14:32:57 147456] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] \Shell\AutoRun\command - E:\dvdcheck.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-04 18:08:20 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-03-04 18:09:06 ComboFix-quarantined-files.txt 2008-03-05 01:08:58 . 2008-02-13 14:09:10 --- E O F ---