ComboFix 08-05-12.1 - brandonS 2008-05-13 16:52:51.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.126 [GMT -7:00] Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\brandonS\Desktop\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\Documents and Settings\brandonS\Application Data\obgarg.exe C:\Documents and Settings\brandonS\Application Data\obgargu.exe C:\Documents and Settings\brandonS\obgarg.exe C:\WINDOWS\pnop32.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\brandonS\Application Data\obgarg.exe C:\Documents and Settings\brandonS\Application Data\obgargu.exe C:\Documents and Settings\brandonS\obgarg.exe C:\WINDOWS\pnop32.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_XDVA025 -------\Legacy_XDVA031 -------\Legacy_XDVA039 -------\Legacy_XDVA078 -------\Legacy_XDVA085 -------\Legacy_XDVA089 -------\Legacy_XDVA090 -------\Legacy_XDVA099 -------\Legacy_XDVA104 -------\Legacy_XDVA114 -------\Legacy_XDVA128 -------\Legacy_XDVA131 -------\Legacy_XDVA136 -------\Service_XDva025 -------\Service_XDva031 -------\Service_XDva039 -------\Service_XDva078 -------\Service_XDva085 -------\Service_XDva089 -------\Service_XDva090 -------\Service_XDva099 -------\Service_XDva104 -------\Service_XDva114 -------\Service_XDva128 -------\Service_XDva131 -------\Service_XDva136 ((((((((((((((((((((((((( Files Created from 2008-04-13 to 2008-05-13 ))))))))))))))))))))))))))))))) . 2008-05-13 16:50 . 2008-05-13 16:51 d-------- C:\Program Files\combofix 2008-05-11 12:52 . 2008-05-11 12:52 d-------- C:\Program Files\Trend Micro 2008-05-10 17:02 . 2008-05-10 17:04 d-------- C:\Program Files\KO_HeavenFireII 2008-05-10 14:32 . 2008-05-10 14:32 d-------- C:\Program Files\new_dabingusa_beta 2008-05-10 13:15 . 2008-05-10 13:15 d-------- C:\WINDOWS\system32\_curSkin 2008-05-10 13:15 . 2008-05-10 14:25 d-------- C:\Documents and Settings\brandonS\Application Data\GameComm 2008-05-08 20:29 . 2008-05-08 21:22 d-------- C:\Program Files\XoftSpySE 2008-05-07 17:07 . 2008-05-10 17:05 17 --a------ C:\WINDOWS\midage.ini 2008-05-07 16:51 . 2008-05-07 16:51 d-------- C:\Documents and Settings\brandonS\KO_HeavenFireII 2008-04-29 18:54 . 2008-04-29 23:29 d-------- C:\Documents and Settings\brandonS\Application Data\Azureus 2008-04-29 18:54 . 2008-04-29 18:54 d-------- C:\Documents and Settings\All Users\Application Data\Azureus 2008-04-29 18:53 . 2008-04-30 13:55 d-------- C:\Program Files\Azureus 2008-04-28 16:33 . 2008-04-29 19:36 d-------- C:\Documents and Settings\brandonS\Application Data\VMware 2008-04-28 16:25 . 2008-04-29 13:41 d-------- C:\Documents and Settings\LocalService\Application Data\VMware 2008-04-28 16:20 . 2008-04-29 21:17 d-------- C:\Documents and Settings\All Users\Application Data\VMware 2008-04-28 15:38 . 2008-04-28 15:39 d-------- C:\Program Files\Common Files\Adobe 2008-04-27 19:29 . 2008-04-28 15:21 d-------- C:\WINDOWS\SxsCaPendDel 2008-04-24 22:54 . 2008-04-24 22:54 d-------- C:\Documents and Settings\brandonS\Application Data\MySpace 2008-04-24 22:53 . 2008-04-25 17:09 d-------- C:\Program Files\MySpace 2008-04-23 19:54 . 2004-08-04 05:00 99,840 --a--c--- C:\WINDOWS\system32\dllcache\advpack.dll 2008-04-19 09:49 . 2008-05-11 20:42 d-------- C:\Program Files\Knight Online 2008-04-19 09:06 . 2008-04-26 08:15 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb 2008-04-19 09:06 . 2008-04-26 08:15 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb 2008-04-18 15:39 . 2008-05-10 23:18 d-------- C:\Program Files\mIRC 2008-04-18 15:39 . 2008-05-11 00:26 d-------- C:\Documents and Settings\brandonS\Application Data\mIRC 2008-04-15 20:35 . 2008-04-18 21:47 d-------- C:\Program Files\SCAR 3.15 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-13 23:23 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-13 23:23 --------- d-----w C:\Program Files\Steam 2008-05-12 23:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2008-05-04 21:59 --------- d-----w C:\Program Files\Windows Live Safety Center 2008-04-28 02:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-04-28 02:27 --------- d-----w C:\Program Files\Microsoft Works 2008-04-28 02:25 --------- d-----w C:\Program Files\MSBuild 2008-04-26 00:05 --------- d-----w C:\Program Files\Microsoft Visual Studio 9.0 2008-04-19 16:49 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-19 04:48 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-04-10 02:10 --------- d-----w C:\Documents and Settings\Rick\Application Data\PCToolsFirewallPlus 2008-04-10 02:10 --------- d-----w C:\Documents and Settings\Rick\Application Data\ESET 2008-04-10 02:09 --------- d-----w C:\Documents and Settings\Felicia\Application Data\PCToolsFirewallPlus 2008-04-10 02:09 --------- d-----w C:\Documents and Settings\Felicia\Application Data\ESET 2008-04-10 02:08 --------- d-----w C:\Documents and Settings\Kathy\Application Data\PCToolsFirewallPlus 2008-04-10 02:08 --------- d-----w C:\Documents and Settings\Kathy\Application Data\ESET 2008-04-08 00:47 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-04-05 03:42 --------- d-----w C:\Documents and Settings\brandonS\Application Data\Ventrilo 2008-04-05 03:40 --------- d-----w C:\Program Files\Ventrilo 2008-04-05 03:39 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-04-05 02:19 16,896 ----a-w C:\WINDOWS\system32\drivers\.sys 2008-04-04 03:55 --------- d-----w C:\Program Files\Microsoft Synchronization Services 2008-04-04 03:55 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition 2008-04-04 03:47 --------- d-----w C:\Program Files\Microsoft SDKs 2008-04-04 03:44 --------- d-----w C:\Program Files\Reference Assemblies 2008-04-04 03:35 --------- d-----w C:\Program Files\MSXML 6.0 2008-03-31 18:26 --------- d-----w C:\Documents and Settings\brandonS\Application Data\teamspeak2 2008-03-31 18:25 --------- d-----w C:\Program Files\Teamspeak2_RC2 2008-03-27 15:33 --------- d-----w C:\Program Files\Java 2008-03-13 05:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7 2008-03-13 04:34 --------- d-----w C:\Program Files\ESET 2008-03-13 04:29 --------- d-----w C:\Documents and Settings\brandonS\Application Data\ESET 2008-03-13 04:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET 2008-03-13 02:12 --------- d-----w C:\Program Files\Google . ((((((((((((((((((((((((((((( snapshot@2008-05-12_16.28.09.84 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-12 22:59:45 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-05-13 23:57:26 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2005-10-21 03:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Steam"="C:\Program Files\Steam\Steam.exe" [2008-03-28 08:07 1271032] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352] "MSMSGS"="C:\Program Files\Messenger\Msmsgs.exe" [2004-10-13 09:24 1694208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 22:05 344064] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-12 20:50 185632] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-07 16:55 267064] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "00PCTFW"="C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" [2007-12-31 10:16 2594712] "egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-12-21 08:21 1443072] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^RAMASST.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\RAMASST.lnk backup=C:\WINDOWS\pss\RAMASST.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG] --a------ 2005-10-15 07:29 88203 C:\WINDOWS\agrsmmsg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] --a------ 2005-05-03 19:43 69632 C:\WINDOWS\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 05:00 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA] --a------ 2005-08-01 05:10 122940 C:\WINDOWS\System32\DLA\DLACTRLW.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LtMoh] --a------ 2005-05-19 08:57 188416 C:\Program Files\ltmoh\Ltmoh.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NDSTray.exe] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PadTouch] --a------ 2005-07-15 11:52 1077322 C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pinger] --a------ 2005-03-17 18:37 151552 c:\toshiba\ivp\ism\pinger.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] --a------ 2005-11-10 12:14 15473664 C:\WINDOWS\RTHDCPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView] --a------ 2005-04-26 17:13 122880 C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh] --a------ 2004-10-14 16:26 688218 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr] --a------ 2004-10-14 16:28 98394 C:\Program Files\Synaptics\SynTP\SynTPLpr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TFncKy] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\THotkey] --a------ 2005-11-25 14:07 352256 C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2007-09-12 20:50 185632 C:\Program Files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSCDSPD] --a------ 2004-12-30 01:32 65536 C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain] --a------ 2005-05-31 22:00 282624 C:\WINDOWS\system32\TPSMain.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tvs] --a------ 2005-11-10 11:24 73728 C:\Program Files\Toshiba\Tvs\TvsTray.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"= "C:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= C:\\TOSHIBA\\IVP\\ISM\\pinger.exe "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "C:\\Program Files\\Steam\\Steam.exe"= "C:\\Program Files\\Steam\\steamapps\\scottpassmore\\counter-strike\\hl.exe"= "C:\\Program Files\\Steam\\steamapps\\scottpassmore\\day of defeat\\hl.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "C:\\Program Files\\Steam\\steamapps\\scottpassmore\\team fortress classic\\hl.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= R0 KR10N;KR10N;C:\WINDOWS\system32\drivers\KR10N.sys [2005-01-12 01:05] R1 pctfw2;pctfw2;C:\WINDOWS\system32\drivers\pctfw2.sys [2008-01-04 15:13] R1 pctmp;PC Tools Firewall Memory Protection Driver;C:\WINDOWS\system32\drivers\pctmp.sys [2008-01-04 15:13] R1 pctssipc;PC Tools Security Suite IPC Driver;C:\WINDOWS\system32\drivers\pctssipc.sys [2008-01-04 15:13] . Contents of the 'Scheduled Tasks' folder "2008-05-03 00:28:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-05-13 04:20:26 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job" - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE "2008-05-14 00:00:18 C:\WINDOWS\Tasks\XoftSpySE 2.job" - C:\Program Files\XoftSpySE\XoftSpy.exe "2008-05-10 17:02:59 C:\WINDOWS\Tasks\XoftSpySE.job" - C:\Program Files\XoftSpySE\XoftSpy.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-13 16:58:25 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\PC Tools Firewall Plus\FWService.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\WINDOWS\system32\DVDRAMSV.exe C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\TOSHIBA\IVP\swupdate\swupdtmr.exe C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2008-05-13 17:05:22 - machine was rebooted [brandonS] ComboFix-quarantined-files.txt 2008-05-14 00:05:18 ComboFix2.txt 2008-05-12 23:28:35 Pre-Run: 38,468,153,344 bytes free Post-Run: 38,394,019,840 bytes free 246 --- E O F --- 2008-04-09 06:04:07