ComboFix 08-05-19.3 - GiB 2008-05-20 1:08:26.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.406 [GMT 2:00] Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\HP\Start Menu\Programs\Startup\Deewoo.lnk C:\Documents and Settings\HP\Start Menu\Programs\Startup\DW_Start.lnk C:\Program Files\webhancer C:\Temp\1cb C:\Temp\1cb\syscheck.log C:\WINDOWS\explore.exe C:\WINDOWS\iexplorer.exe C:\WINDOWS\system32\_003878_.tmp.dll C:\WINDOWS\system32\_003879_.tmp.dll C:\WINDOWS\system32\_003880_.tmp.dll C:\WINDOWS\system32\_003881_.tmp.dll C:\WINDOWS\system32\_003888_.tmp.dll C:\WINDOWS\system32\_003889_.tmp.dll C:\WINDOWS\system32\_003890_.tmp.dll C:\WINDOWS\system32\_003891_.tmp.dll C:\WINDOWS\system32\_003893_.tmp.dll C:\WINDOWS\system32\_003894_.tmp.dll C:\WINDOWS\system32\_003897_.tmp.dll C:\WINDOWS\system32\_003898_.tmp.dll C:\WINDOWS\system32\_003900_.tmp.dll C:\WINDOWS\system32\_003901_.tmp.dll C:\WINDOWS\system32\_003902_.tmp.dll C:\WINDOWS\system32\_003904_.tmp.dll C:\WINDOWS\system32\_003907_.tmp.dll C:\WINDOWS\system32\_003908_.tmp.dll C:\WINDOWS\system32\_003912_.tmp.dll C:\WINDOWS\system32\_003913_.tmp.dll C:\WINDOWS\system32\_003915_.tmp.dll C:\WINDOWS\system32\_003917_.tmp.dll C:\WINDOWS\system32\_003918_.tmp.dll C:\WINDOWS\system32\_003920_.tmp.dll C:\WINDOWS\system32\_003921_.tmp.dll C:\WINDOWS\system32\_003922_.tmp.dll C:\WINDOWS\system32\_003923_.tmp.dll C:\WINDOWS\system32\_003924_.tmp.dll C:\WINDOWS\system32\_003927_.tmp.dll C:\WINDOWS\system32\_003928_.tmp.dll C:\WINDOWS\system32\_003929_.tmp.dll C:\WINDOWS\system32\_003930_.tmp.dll C:\WINDOWS\system32\_003931_.tmp.dll C:\WINDOWS\system32\_003936_.tmp.dll C:\WINDOWS\system32\_003938_.tmp.dll C:\WINDOWS\system32\_003939_.tmp.dll C:\WINDOWS\system32\iihiOXyb.ini C:\WINDOWS\system32\iihiOXyb.ini2 C:\WINDOWS\system32\mcackfhd.ini C:\WINDOWS\system32\MSINET.oca C:\WINDOWS\system32\msnav32.ax C:\WINDOWS\system32\pac.txt C:\WINDOWS\system32\pjoixebv.ini C:\WINDOWS\system32\sgealyqw.ini C:\WINDOWS\system32\zxdnt3d.cfg C:\WINDOWS\x.exe C:\WINDOWS\y.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_CLBDRIVER -------\Service_clbdriver ((((((((((((((((((((((((( Files Created from 2008-04-19 to 2008-05-19 ))))))))))))))))))))))))))))))) . 2008-05-19 23:25 . 2008-05-19 23:25 d-------- C:\Documents and Settings\LocalService\Application Data\VCOM 2008-05-19 23:24 . 2008-05-19 23:24 d-------- C:\Documents and Settings\SG 2008-05-19 23:24 . 2008-05-20 01:16 1,024 --ah----- C:\Documents and Settings\SG\ntuser.dat.LOG 2008-05-19 09:03 . 2008-05-19 09:03 dr-h----- C:\Documents and Settings\GiB\Application Data\yahoo! 2008-05-19 01:11 . 2008-05-19 01:11 d-------- C:\Documents and Settings\GiB\Application Data\VCOM 2008-05-18 14:51 . 2008-05-18 14:51 d-------- C:\Documents and Settings\HP\Application Data\Deskbar_{A8B84A8A-9BDB-48c9-AF3D-296360B98F59} 2008-05-18 14:50 . 2008-05-18 14:51 d-------- C:\Program Files\dbar 2008-05-18 14:49 . 2008-05-18 14:49 d-------- C:\Documents and Settings\LocalService\Application Data\Acronis 2008-05-18 14:45 . 2008-05-18 14:45 117,248 --------- C:\WINDOWS\system32\wqylaegs.dll 2008-05-18 14:40 . 2008-05-18 14:40 91,700 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-05-18 14:40 . 2008-05-18 14:40 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-05-18 14:39 . 2008-05-18 14:39 d-------- C:\Program Files\Kaspersky Lab 2008-05-18 14:39 . 2008-05-20 01:18 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-05-18 14:39 . 2008-05-20 01:16 5,083,936 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-05-18 14:39 . 2008-05-20 01:14 70,160 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-05-18 14:39 . 2008-05-20 01:19 18,720 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-05-18 14:39 . 2008-05-20 01:14 3,800 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2008-05-18 14:38 . 2008-05-18 14:38 d-------- C:\kav 2008-05-18 14:27 . 2007-09-12 22:54 392,320 --a------ C:\WINDOWS\system32\drivers\OLD4D4.tmp 2008-05-18 14:27 . 2008-05-18 14:27 368,544 --a------ C:\WINDOWS\system32\drivers\tdrpman.sys 2008-05-18 14:27 . 2007-09-12 22:54 32,768 --a------ C:\WINDOWS\system32\drivers\OLD4D7.tmp 2008-05-18 14:23 . 2008-05-18 14:23 371,200 --------- C:\WINDOWS\system32\byXOihii.dll 2008-05-18 14:21 . 2008-05-19 20:45 d-------- C:\Documents and Settings\HP\Application Data\uTorrent 2008-05-18 14:21 . 2008-05-18 14:20 6,656 --a------ C:\WINDOWS\system32\drivers\OLD497.tmp 2008-05-18 14:21 . 2008-05-18 14:21 861 --a------ C:\WINDOWS\system32\winpfz33.sys 2008-05-18 14:20 . 2008-05-18 14:21 d-------- C:\Program Files\uTorrent 2008-05-18 14:20 . 2008-05-18 14:20 63,902 --a------ C:\WINDOWS\system32\{939e6d22-7cdc-90e5-55e9-b76327bf3a76}.dll-uninst.exe 2008-05-18 14:20 . 2006-03-16 13:00 4,224 --a------ C:\WINDOWS\system32\beep.sys 2008-05-18 14:19 . 2008-05-18 14:19 d-------- C:\WINDOWS\system32\rDA 2008-05-18 14:19 . 2008-05-18 14:19 d-------- C:\WINDOWS\system32\logXv06 2008-05-18 14:19 . 2008-05-19 02:05 d-------- C:\WINDOWS\system32\emL1 2008-05-18 14:19 . 2008-05-19 20:26 d-------- C:\WINDOWS\system32\3056v 2008-05-18 14:19 . 2008-05-18 14:19 d-------- C:\TEMP\dmpxp32 2008-05-18 14:19 . 2008-05-18 16:20 d-------- C:\Program Files\winvi 2008-05-18 14:18 . 2008-05-18 14:18 59,392 --a------ C:\WINDOWS\system32\opnkklkl.dll 2008-05-18 14:18 . 2008-05-18 14:18 4 --a------ C:\WINDOWS\system32\hljwugsf.bin 2008-05-15 20:27 . 2008-05-20 01:15 2,910 --a------ C:\WINDOWS\system32\OODBS.lor 2008-05-15 17:37 . 2008-05-17 15:35 d--hs---- C:\VCOM 2008-05-15 17:37 . 2008-05-15 17:37 d-------- C:\Program Files\VCOM 2008-05-15 17:37 . 2008-05-15 17:37 d-------- C:\Documents and Settings\HP\Application Data\VCOM 2008-05-13 21:23 . 2008-05-13 21:23 d-------- C:\Program Files\FAST Defrag 2008-05-13 21:13 . 2008-05-13 21:13 d-------- C:\Program Files\OO Software 2008-05-13 17:09 . 2008-05-13 17:16 d-------- C:\WINDOWS\ServicePackFiles 2008-05-12 23:41 . 2008-05-13 17:15 d-------- C:\WINDOWS\system32\scripting 2008-05-12 23:41 . 2008-05-13 17:15 d-------- C:\WINDOWS\system32\en 2008-05-12 23:41 . 2008-05-13 17:15 d-------- C:\WINDOWS\system32\bits 2008-05-12 23:41 . 2008-05-13 17:15 d-------- C:\WINDOWS\l2schemas 2008-05-12 23:23 . 2008-04-13 21:24 2,145,280 --a------ C:\WINDOWS\system32\ntoskrnl.exe 2008-05-12 12:44 . 2008-04-13 19:39 689,152 --a------ C:\WINDOWS\system32\SET130C.tmp 2008-05-12 12:43 . 2008-04-14 02:12 858,624 --a------ C:\WINDOWS\system32\SET2E5.tmp 2008-05-12 12:42 . 2008-04-14 02:12 8,461,312 --a------ C:\WINDOWS\system32\SET321.tmp 2008-05-12 12:41 . 2008-04-14 02:12 1,737,856 --------- C:\WINDOWS\system32\mtxparhd.dll 2008-05-12 12:40 . 2008-04-14 02:11 2,843,136 --a------ C:\WINDOWS\system32\SET405.tmp 2008-05-12 12:39 . 2008-04-14 02:11 1,028,096 --a------ C:\WINDOWS\system32\SET449.tmp 2008-05-12 12:38 . 2008-04-14 02:11 512,000 --a------ C:\WINDOWS\system32\SET473.tmp 2008-05-12 12:37 . 2008-04-14 02:11 1,082,368 --a------ C:\WINDOWS\system32\SET4D2.tmp 2008-05-12 12:36 . 2008-04-14 02:11 1,689,088 --a------ C:\WINDOWS\system32\SET138F.tmp 2008-05-12 12:35 . 2008-04-14 02:11 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll 2008-05-12 11:16 . 2008-05-12 11:16 d-------- C:\Program Files\Broadcom 2008-05-12 11:16 . 2008-05-12 11:16 d-------- C:\Documents and Settings\HP\Application Data\InstallShield . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-19 23:19 --------- d-----w C:\Documents and Settings\LocalService\Application Data\VMware 2008-05-19 23:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\VMware 2008-05-19 23:18 --------- d-----w C:\Program Files\BOINC 2008-05-19 23:18 --------- d-----w C:\Documents and Settings\GiB\Application Data\VMware 2008-05-19 18:43 --------- d-----w C:\Documents and Settings\HP\Application Data\VMware 2008-05-18 12:35 --------- d-----w C:\Program Files\BitDefender 2008-05-18 12:34 81,984 ----a-w C:\WINDOWS\system32\bdod.bin 2008-05-18 12:27 441,760 ----a-w C:\WINDOWS\system32\drivers\timntr.sys 2008-05-18 12:27 44,384 ----a-w C:\WINDOWS\system32\drivers\tifsfilt.sys 2008-05-18 12:27 129,248 ----a-w C:\WINDOWS\system32\drivers\snapman.sys 2008-05-18 12:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Acronis 2008-05-18 11:48 --------- d-----w C:\Documents and Settings\HP\Application Data\Skype 2008-05-18 08:07 --------- d-----w C:\Documents and Settings\HP\Application Data\skypePM 2008-05-15 08:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-05-12 09:17 822,272 ----a-w C:\WINDOWS\system32\drivers\BCMWL5.SYS 2008-05-09 14:43 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-04-16 12:49 --------- d-----w C:\Program Files\TechSmith 2008-04-16 12:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\TechSmith 2008-04-14 15:58 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\VMware 2008-04-14 15:49 --------- d-----w C:\Program Files\Common Files\BitDefender 2008-04-14 13:00 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-04-14 13:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-04-14 12:58 --------- d-----w C:\Program Files\Symantec 2008-04-14 12:58 --------- d-----w C:\Program Files\Norton 360 2008-04-14 03:42 985,088 ----a-w C:\WINDOWS\system32\setupapi.dll 2008-04-14 03:42 11,264 ----a-w C:\WINDOWS\system32\spnpinst.exe 2008-04-14 03:41 423,936 ----a-w C:\WINDOWS\system32\licdll.dll 2008-04-14 00:25 1,804 ----a-w C:\WINDOWS\system32\dcache.bin 2008-04-14 00:16 329,728 ----a-w C:\WINDOWS\system32\netsetup.exe 2008-04-14 00:15 218,134 ----a-w C:\WINDOWS\AppPatch\SET674.tmp 2008-04-14 00:15 204,396 ----a-w C:\WINDOWS\AppPatch\SET673.tmp 2008-04-14 00:15 1,202,774 ----a-w C:\WINDOWS\AppPatch\SET672.tmp 2008-04-14 00:13 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll 2008-04-14 00:13 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll 2008-04-14 00:13 40,840 ----a-w C:\WINDOWS\system32\drivers\termdd.sys 2008-04-14 00:13 21,896 ----a-w C:\WINDOWS\system32\drivers\tdtcp.sys 2008-04-14 00:13 139,656 ----a-w C:\WINDOWS\system32\drivers\rdpwd.sys 2008-04-14 00:13 12,168 ----a-w C:\WINDOWS\system32\tsddd.dll 2008-04-14 00:13 12,040 ----a-w C:\WINDOWS\system32\drivers\tdpipe.sys 2008-04-14 00:11 997,376 ----a-w C:\WINDOWS\system32\SET408.tmp 2008-04-14 00:10 86,016 ----a-w C:\WINDOWS\system32\SET311.tmp 2008-04-14 00:10 53,279 ----a-w C:\WINDOWS\system32\odbcji32.dll 2008-04-14 00:10 4,126 ----a-w C:\WINDOWS\system32\msdxmlc.dll 2008-04-14 00:10 3,584 ----a-w C:\WINDOWS\system32\msafd.dll 2008-04-14 00:10 294,912 ----a-w C:\WINDOWS\system32\SET41D.tmp 2008-04-14 00:10 177,152 ----a-w C:\WINDOWS\system32\SET134D.tmp 2008-04-14 00:10 14,848 ----a-w C:\WINDOWS\system32\SET421.tmp 2008-04-13 19:30 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys 2008-04-13 19:28 175,744 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys 2008-04-13 19:21 162,816 ----a-w C:\WINDOWS\system32\drivers\netbt.sys 2008-04-13 19:20 91,520 ----a-w C:\WINDOWS\system32\drivers\ndiswan.sys 2008-04-13 19:20 361,344 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-04-13 19:20 182,656 ----a-w C:\WINDOWS\system32\drivers\ndis.sys 2008-04-13 19:19 75,264 ----a-w C:\WINDOWS\system32\drivers\ipsec.sys 2008-04-13 19:19 51,328 ----a-w C:\WINDOWS\system32\drivers\rasl2tp.sys 2008-04-13 19:19 48,384 ----a-w C:\WINDOWS\system32\drivers\raspptp.sys 2008-04-13 19:19 146,048 ----a-w C:\WINDOWS\system32\drivers\portcls.sys 2008-04-13 19:19 138,112 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-04-13 19:18 52,480 ----a-w C:\WINDOWS\system32\drivers\i8042prt.sys 2008-04-13 19:17 83,072 ----a-w C:\WINDOWS\system32\drivers\wdmaud.sys 2008-04-13 19:17 456,576 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys 2008-04-13 19:17 105,344 ----a-w C:\WINDOWS\system32\drivers\mup.sys 2008-04-13 19:16 49,536 ----a-w C:\WINDOWS\system32\drivers\classpnp.sys 2008-04-13 19:16 141,056 ----a-w C:\WINDOWS\system32\drivers\ks.sys 2008-04-13 19:15 64,512 ----a-w C:\WINDOWS\system32\drivers\serial.sys 2008-04-13 19:15 60,800 ----a-w C:\WINDOWS\system32\drivers\sysaudio.sys 2008-04-13 19:15 574,976 ----a-w C:\WINDOWS\system32\drivers\ntfs.sys 2008-04-13 19:15 334,848 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-04-13 19:14 63,744 ----a-w C:\WINDOWS\system32\drivers\cdfs.sys 2008-04-13 19:14 143,744 ----a-w C:\WINDOWS\system32\drivers\fastfat.sys 2008-04-13 19:00 30,080 ----a-w C:\WINDOWS\system32\drivers\modem.sys 2008-04-13 19:00 225,664 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-04-13 19:00 19,072 ----a-w C:\WINDOWS\system32\drivers\tdi.sys 2008-04-13 18:57 41,472 ----a-w C:\WINDOWS\system32\drivers\raspppoe.sys 2008-04-13 18:57 40,576 ----a-w C:\WINDOWS\system32\drivers\ndproxy.sys 2008-04-13 18:57 34,560 ----a-w C:\WINDOWS\system32\drivers\wanarp.sys 2008-04-13 18:57 20,864 ----a-w C:\WINDOWS\system32\drivers\ipinip.sys 2008-04-13 18:57 152,832 ----a-w C:\WINDOWS\system32\drivers\ipnat.sys 2008-04-13 18:57 14,336 ----a-w C:\WINDOWS\system32\drivers\asyncmac.sys 2008-04-13 18:57 10,112 ----a-w C:\WINDOWS\system32\drivers\ndistapi.sys 2008-04-13 18:56 88,320 ----a-w C:\WINDOWS\system32\drivers\nwlnkipx.sys 2008-04-13 18:56 69,120 ----a-w C:\WINDOWS\system32\drivers\psched.sys 2008-04-13 18:56 35,072 ----a-w C:\WINDOWS\system32\drivers\msgpc.sys 2008-04-13 18:56 34,688 ----a-w C:\WINDOWS\system32\drivers\netbios.sys 2008-04-13 18:56 30,592 ----a-w C:\WINDOWS\system32\drivers\rndismp.sys 2008-04-13 18:56 30,592 ------w C:\WINDOWS\system32\drivers\rndismpx.sys 2008-04-13 18:56 12,800 ----a-w C:\WINDOWS\system32\drivers\usb8023.sys 2008-04-13 18:56 12,800 ------w C:\WINDOWS\system32\drivers\usb8023x.sys 2008-04-13 18:56 12,288 ----a-w C:\WINDOWS\system32\drivers\tunmp.sys 2008-04-13 18:55 202,624 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-04-13 18:55 14,592 ----a-w C:\WINDOWS\system32\drivers\ndisuio.sys 2008-04-13 18:54 11,264 ----a-w C:\WINDOWS\system32\drivers\irenum.sys 2008-04-13 18:53 71,552 ----a-w C:\WINDOWS\system32\drivers\bridge.sys 2008-04-13 18:53 40,320 ----a-w C:\WINDOWS\system32\drivers\nmnt.sys 2008-04-13 18:53 36,608 ----a-w C:\WINDOWS\system32\drivers\ip6fw.sys 2008-04-13 18:53 264,832 ----a-w C:\WINDOWS\system32\drivers\http.sys 2008-04-13 18:51 61,824 ----a-w C:\WINDOWS\system32\drivers\nic1394.sys 2008-04-13 18:51 60,800 ----a-w C:\WINDOWS\system32\drivers\arp1394.sys 2008-04-13 18:51 59,904 ----a-w C:\WINDOWS\system32\drivers\atmarpc.sys 2008-04-13 18:51 55,808 ----a-w C:\WINDOWS\system32\drivers\atmlane.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00110011-4b0b-44d5-9718-90c88817369b}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{03AF8B48-C071-43BF-8C0D-D4E6D928BB1E}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{086ae192-23a6-48d6-96ec-715f53797e85}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{150fa160-130d-451f-b863-b655061432ba}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{17da0c9e-4a27-4ac5-bb75-5d24b8cdb972}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2BD8A18E-1859-4424-8273-4AB6C84EE59F}] 2008-05-18 14:23 371200 --------- C:\WINDOWS\system32\byXOihii.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2d38a51a-23c9-48a1-a33c-48675aa2b494}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2e9caff6-30c7-4208-8807-e79d4ec6f806}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{467faeb2-5f5b-4c81-bae0-2a4752ca7f4e}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E3FBD86-243A-47B0-B795-85EB759DA747}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5321e378-ffad-4999-8c62-03ca8155f0b3}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{587dbf2d-9145-4c9e-92c2-1f953da73773}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6cc1c91a-ae8b-4373-a5b4-28ba1851e39a}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{79369d5c-2903-4b7a-ade2-d5e0dee14d24}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{799a370d-5993-4887-9df7-0a4756a77d00}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7D6199E7-542B-4FEB-B83F-96E9A378C443}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{98dbbf16-ca43-4c33-be80-99e6694468a4}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a55581dc-2cdb-4089-8878-71a080b22342}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b847676d-72ac-4393-bfff-43a1eb979352}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bb89b7b6-9209-8369-99d9-b4578972d8e8}] C:\WINDOWS\system32\{939e6d22-7cdc-90e5-55e9-b76327bf3a76}.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bc97b254-b2b9-4d40-971d-78e0978f5f26}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CC11617C-259E-429c-9063-7D70B8355EBD}] 2007-11-14 15:36 1486848 --a------ C:\Program Files\dbar\Deskbar.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cf021f40-3e14-23a5-cba2-717765721306}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e2ddf680-9905-4dee-8c64-0a5de7fe133c}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e3eebbe8-9cab-4c76-b26a-747e25ebb4c6}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e7afff2a-1b57-49c7-bf6b-e5123394c970}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F535AA22-81FC-4ADD-8CF6-D1D9DDE7B56B}] 2008-05-18 14:18 59392 --a------ C:\WINDOWS\system32\opnkklkl.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fd9bc004-8331-4457-b830-4759ff704c22}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= "C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL" [2007-12-11 18:32 267592] [HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL [2007-12-11 18:32 267592] [HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 02:12 15360] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-14 02:12 1695232] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-06 05:56 64512] "RUNFBI"="c:\windows\regedit.exe" [2008-04-14 02:12 146432] "hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-04 06:58 458752] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496] "NvCplDaemon"="RUNDLL32.exe" [2008-04-14 02:12 33280 C:\WINDOWS\system32\rundll32.exe] "NvMediaCenter"="RUNDLL32.exe" [2008-04-14 02:12 33280 C:\WINDOWS\system32\rundll32.exe] "nwiz"="nwiz.exe" [1857-01-01 10:00 1617920 C:\WINDOWS\system32\nwiz.exe] "High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-07-26 22:44 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-08 00:47 827392] "QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2006-07-11 23:55 102400] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152] "QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 13:33 163840] "Cpqset"="C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-05-30 18:02 40960] "RecGuard"="C:\Windows\SMINST\RecGuard.exe" [ ] "Reminder"="C:\Windows\CREATOR\Remind_XP.exe" [ ] "AutoLogon"="regedit.exe" [2008-04-14 02:12 146432 C:\WINDOWS\regedit.exe] "Acronis Scheduler2 Service"="C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe" [2007-10-30 20:07 140568] "BluetoothAuthenticationAgent"="rundll32.exe" [2008-04-14 02:12 33280 C:\WINDOWS\system32\rundll32.exe] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-10-08 13:14 185896] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 12:52 221184] "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-01-18 18:47 458752] "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-01-18 18:37 217088] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 08:00 33648] "OSSelectorReinstall"="C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe" [2006-04-12 16:15 1261475] "vmware-tray"="C:\Program Files\VMware\VMware Workstation\vmware-tray.exe" [2007-08-21 21:02 72240] "VMware hqtray"="C:\Program Files\VMware\VMware Workstation\hqtray.exe" [2007-08-21 21:01 55856] "CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 21:21 57344] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-05-18 12:29 49152] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 18:38 583048] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [ ] "QuickTime Task"="C:\Program Files\QuickTime Alternative\QTTask.exe" [2008-02-01 00:13 385024] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2005-01-01 21:00 155648] "Fix-It AV"="C:\PROGRA~1\VCOM\Fix-It\MemCheck.exe" [2003-06-10 15:58 32768] "webHancer Agent"="C:\Program Files\webHancer\Programs\whagent.exe" [ ] "{B4-44-44-41-DW}"="c:\windows\system32\jswnw64l.exe" [ ] "{d36021b7-1b2b-b32f-ff81-54ffcfe31671}"="C:\WINDOWS\system32\{939e6d22-7cdc-90e5-55e9-b76327bf3a76}.dll" [ ] "runner1"="C:\WINDOWS\mrofinu1000106.exe" [ ] "ExploreUpdSched"="C:\WINDOWS\system32\mcnttkdm.exe" [ ] "TrueImageMonitor.exe"="C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2007-10-30 20:06 2595616] "AcronisTimounterMonitor"="C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe" [2007-10-30 20:11 909208] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-08 18:36 227856] "dbar_starter"="C:\Documents and Settings\HP\Application Data\Deskbar_{A8B84A8A-9BDB-48c9-AF3D-296360B98F59}\starter.exe" [ ] "50cb44ee"="C:\WINDOWS\system32\dhfkcacm.dll" [ ] "combofix"="C:\WINDOWS\system32\CF2503.exe" [2008-04-14 02:12 389120] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 02:12 15360] C:\Documents and Settings\HP\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 21:16:50 113664] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ BlueSoleil.lnk - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2005-06-15 17:47:10 1208320] BOINC Manager.lnk - C:\Program Files\BOINC\boincmgr.exe [2008-03-04 14:00:20 4150016] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26 282624] Inicializa��o r�pida do HP Photosmart Premier.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 17:39:30 73728] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme "DisableTaskMgr"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{F535AA22-81FC-4ADD-8CF6-D1D9DDE7B56B}"= C:\WINDOWS\system32\opnkklkl.dll [2008-05-18 14:18 59392] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,C:\\WINDOWS\\system32\\xwusuhzh.exe," [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnkklkl] opnkklkl.dll 2008-05-18 14:18 59392 C:\WINDOWS\system32\opnkklkl.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli scecli [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\clbdriver.sys] @="driver" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Ashampoo Magical Defrag.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Ashampoo Magical Defrag.lnk backup=C:\WINDOWS\pss\Ashampoo Magical Defrag.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^HP^Start Menu^Programs^Startup^BOINC Manager.lnk] path=C:\Documents and Settings\HP\Start Menu\Programs\Startup\BOINC Manager.lnk backup=C:\WINDOWS\pss\BOINC Manager.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcronisTimounterMonitor] --a------ 2007-10-30 20:11 909208 C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe] --a------ 2007-10-30 20:06 2595616 C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "FirewallDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\VoipStunt.com\\VoipStunt\\VoipStunt.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "C:\\Program Files\\VoipBuster.com\\VoipBuster\\VoipBuster.exe"= "C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= R0 tdrpman;Acronis Try&Decide and Restore Points filter;C:\WINDOWS\system32\DRIVERS\tdrpman.sys [2008-05-18 14:27] R2 TryAndDecideService;Acronis Try And Decide Service;"C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe" [2007-10-30 20:51] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28] R3 nvsmu;nvsmu;C:\WINDOWS\system32\DRIVERS\nvsmu.sys [2006-03-06 08:49] S2 Agendador do LiveUpdate autom�tico;Agendador do LiveUpdate autom�tico;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2007-09-12 19:27] S3 FBIKB_NT;FBIKB_NT;C:\WINDOWS\system32\Drivers\FBIKB_NT.Sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4cf32f33-7d00-11dc-bba2-001636a9095c}] \Shell\Auto\command - E:\note.exe e \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL note.exe e . Contents of the 'Scheduled Tasks' folder "2008-05-19 07:48:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-20 01:17:11 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe???????????? C:\WINDOWS\system32\opnkklkl.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\ehome\ehrecvr.exe C:\WINDOWS\ehome\ehSched.exe C:\PROGRA~1\VCOM\Fix-It\mxtask.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe C:\WINDOWS\system32\vmnat.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\WINDOWS\ehome\mcrdsvc.exe C:\Program Files\VMware\VMware Workstation\vmware-authd.exe C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe C:\WINDOWS\system32\vmnetdhcp.exe C:\PROGRA~1\VCOM\Fix-It\mxtask.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe C:\WINDOWS\ehome\ehmsas.exe . ************************************************************************** . Completion time: 2008-05-20 1:23:25 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-19 23:23:15 Pre-Run: 5,748,981,760 bytes free Post-Run: 7,377,883,136 bytes free 474 --- E O F --- 2008-05-18 08:10:34