ComboFix 08-06-20.4 - Panthro 2008-06-23 15:30:02.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2576 [GMT -5:00] Running from: C:\Documents and Settings\[removed]\Desktop\New Folder\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\dbfb.dll . ((((((((((((((((((((((((( Files Created from 2008-05-23 to 2008-06-23 ))))))))))))))))))))))))))))))) . 2008-06-23 14:56 . 2008-06-23 14:56 d-------- C:\Documents and Settings\All Users\Application Data\SITEguard 2008-06-23 14:56 . 2008-06-23 14:56 504 --a------ C:\WINDOWS\system32\drivers\kgpcpy.cfg 2008-06-23 14:55 . 2008-06-23 14:55 d-------- C:\Program Files\STOPzilla! 2008-06-23 14:55 . 2008-06-23 14:55 d-------- C:\Program Files\Common Files\iS3 2008-06-23 14:55 . 2008-06-23 15:27 d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla! 2008-06-23 11:33 . 2003-03-31 07:00 271,067 --a------ C:\WINDOWS\system32\WINLOGON.EX_ 2008-06-23 09:42 . 2008-06-23 09:42 d-------- C:\Program Files\Trend Micro 2008-06-21 16:41 . 2004-08-04 02:56 1,689,088 ---h---t- C:\WINDOWS\system32\9b70280.dll 2008-06-21 16:41 . 2004-08-04 02:56 1,689,088 ---h---t- C:\WINDOWS\system32\1d928a64.dll 2008-06-21 16:41 . 2004-08-04 02:56 82,944 ---h---t- C:\WINDOWS\system32\9d94cca.dll 2008-06-21 16:41 . 2004-08-04 02:56 82,944 ---h---t- C:\WINDOWS\system32\34cd0980.dll 2008-06-21 16:38 . 2008-06-21 16:38 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-06-21 16:34 . 2008-06-21 16:34 d-------- C:\WINDOWS\NV7641172.TMP 2008-06-21 13:24 . 2008-06-21 13:24 33,792 --a------ C:\WINDOWS\system32\jkkIBUkk.dll 2008-06-21 10:08 . 2008-06-21 10:08 d-------- C:\WINDOWS\nvidia icons 2008-06-20 07:56 . 2008-06-20 07:56 d-------- C:\Program Files\Codelobster Software 2008-06-19 13:30 . 2008-06-13 08:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-12 15:09 . 2008-06-12 15:09 258,048 -ra------ C:\WINDOWS\system32\SZBase5.dll 2008-06-12 15:08 . 2008-06-12 15:08 401,408 -ra------ C:\WINDOWS\system32\SZComp5.dll 2008-06-12 10:11 . 2008-06-12 10:11 364,544 -ra------ C:\WINDOWS\system32\IS3DBA5.dll 2008-06-12 10:11 . 2008-06-12 10:11 126,976 -ra------ C:\WINDOWS\system32\IS3HTUI5.dll 2008-06-12 10:10 . 2008-06-12 10:10 372,736 -ra------ C:\WINDOWS\system32\IS3UI5.dll 2008-06-12 10:10 . 2008-06-12 10:10 61,440 -ra------ C:\WINDOWS\system32\IS3Hks5.dll 2008-06-12 10:10 . 2008-06-12 10:10 23,040 -ra------ C:\WINDOWS\system32\IS3XDat5.dll 2008-06-12 10:09 . 2008-06-12 10:09 196,608 -ra------ C:\WINDOWS\system32\IS3Win325.dll 2008-06-12 10:08 . 2008-06-12 10:08 94,208 -ra------ C:\WINDOWS\system32\IS3Inet5.dll 2008-06-12 10:08 . 2008-06-12 10:08 90,112 -ra------ C:\WINDOWS\system32\IS3Svc5.dll 2008-06-12 10:05 . 2008-06-12 10:05 708,608 -ra------ C:\WINDOWS\system32\IS3Base5.dll 2008-06-02 14:10 . 2008-06-02 14:10 d-------- C:\Program Files\PC Drivers HeadQuarters 2008-06-02 14:10 . 2008-06-02 14:10 d-------- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters 2008-06-02 12:03 . 1995-11-02 00:00 331,776 --a------ C:\Documents and Settings\Panthro\ACMSETUP.EXE 2008-06-02 12:03 . 1995-11-02 00:00 249,344 --a------ C:\Documents and Settings\Panthro\MSSETUP.DLL 2008-06-02 12:03 . 1995-11-02 00:00 189,952 --a------ C:\Documents and Settings\Panthro\MSADTUSA.DLL 2008-06-02 12:03 . 1995-11-02 00:00 72,992 --a------ C:\Documents and Settings\Panthro\SETUP.EXE 2008-06-02 12:03 . 1995-11-02 00:00 67,584 --a------ C:\Documents and Settings\Panthro\MSACCCAH.DLL 2008-06-02 12:03 . 1995-11-02 00:00 38,352 --a------ C:\Documents and Settings\Panthro\EXPAND.EXE 2008-06-02 10:05 . 2008-06-02 11:48 8,628 --ah----- C:\WINDOWS\system32\myodbc3.GID 2008-06-02 08:33 . 2007-11-08 23:23 4,796,472 --a------ C:\WINDOWS\system32\php5ts.dll 2008-06-01 19:11 . 2008-06-02 12:50 502 --a------ C:\WINDOWS\my.ini 2008-06-01 18:48 . 2008-06-01 16:52 482 --a------ C:\WINDOWS\my.ini.old 2008-06-01 16:47 . 2008-06-01 16:50 d-------- C:\xampp 2008-06-01 16:35 . 2008-06-01 18:55 5,367 --a------ C:\WINDOWS\my.ini.older.ini 2008-05-31 07:19 . 2007-11-08 23:23 2,035,712 --a------ C:\WINDOWS\system32\libmySQL.dll 2008-05-31 07:01 . 2008-05-31 07:01 d-------- C:\Program Files\MySQL 2008-05-30 13:00 . 2008-06-01 07:59 d-------- C:\Documents and Settings\Panthro\Application Data\phpDesigner 2008 2008-05-30 12:59 . 2008-06-23 08:14 d-------- C:\Program Files\phpDesigner 2008 2008-05-28 10:45 . 2008-05-28 10:45 d-------- C:\Documents and Settings\Panthro\Application Data\SmartFTP 2008-05-28 10:44 . 2008-05-28 10:44 d-------- C:\Program Files\SmartFTP Client 3.0 Setup Files 2008-05-28 10:44 . 2008-05-28 10:44 d-------- C:\Program Files\SmartFTP Client 2008-05-24 14:02 . 2008-05-22 18:25 0 --a------ C:\WINDOWS\php.ini.clbak . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-22 23:00 --------- d-----w C:\Program Files\Norton Security Scan 2008-06-20 21:18 --------- d-----w C:\Documents and Settings\Panthro\Application Data\FileZilla 2008-06-20 13:20 --------- d-----w C:\Program Files\FileZilla FTP Client 2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-05-30 16:59 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-05-28 18:07 960 --sha-w C:\4dzjaeh0.sys 2008-05-23 18:17 --------- d-----w C:\Documents and Settings\Panthro\Application Data\ClPhpEd 2008-05-13 15:03 34,432 ----a-r C:\WINDOWS\system32\drivers\SZKG.sys 2008-05-09 21:43 --------- d-----w C:\Program Files\Hard Disk Sentinel 2008-05-08 20:39 --------- d-----w C:\Program Files\SD 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-03 12:38 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-03 12:38 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-05-03 12:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\InstallShield 2008-05-02 21:38 --------- d-----w C:\Program Files\Build A Lot 2008-05-02 21:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\HipSoft 2008-05-02 21:32 --------- d-----w C:\Program Files\The Wonderful Wizard of Oz 2008-05-02 21:26 --------- d-----w C:\Program Files\Mystery Case Files - Ravenhearst 2008-05-02 15:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia 2008-05-02 15:11 --------- d-----w C:\Program Files\BFG 2008-05-01 16:54 --------- d-----w C:\Program Files\Banner Maker Pro 6 2008-04-30 22:27 442,368 ----a-w C:\WINDOWS\system32\NVUNINST.EXE 2008-04-29 23:41 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-04-29 23:11 --------- d-----w C:\Program Files\Pets Fun House 2008-04-29 19:22 --------- d-----w C:\Program Files\Wheel of Fortune 2 2008-04-29 19:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\BigFishGamesCache 2008-04-29 19:15 0 ----a-w C:\Program Files\temp01 2008-04-29 19:15 --------- d-----w C:\Program Files\bfgclient 2008-04-27 18:26 --------- d-----w C:\Program Files\Sun 2008-04-27 18:26 --------- d-----w C:\Program Files\Java 2008-04-26 17:29 --------- d-----w C:\Program Files\Free-Soft 2008-04-25 23:44 --------- d-----w C:\Program Files\Arcade! 2008-04-25 19:19 --------- d-----w C:\Documents and Settings\Panthro\Application Data\Yahoo! 2008-04-25 19:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2008-04-24 12:41 --------- d-----w C:\Documents and Settings\Panthro\Application Data\CodeLobster Php Edition 2008-04-21 07:04 659,456 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-12 22:27 1,049,519 ----a-w C:\WINDOWS\Prison Tycoon 3 Uninstaller.exe 2008-04-12 05:38 6,660,096 ----a-w C:\WINDOWS\system32\myodbc3S.dll 2008-04-12 05:38 2,187,264 ----a-w C:\WINDOWS\system32\myodbc3.dll 2008-04-12 05:38 114,688 ----a-w C:\WINDOWS\system32\myodbc3i.exe 2008-04-12 05:38 106,496 ----a-w C:\WINDOWS\system32\myodbc3m.exe 2008-03-29 15:48 109,568 ------w C:\WINDOWS\system32\pxinsi64.exe 2008-03-29 15:48 108,544 ------w C:\WINDOWS\system32\pxcpyi64.exe 2008-03-29 15:43 82,432 ----a-w C:\WINDOWS\system32\msxml4r.dll 2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F8F84CF-DCBA-4426-AC18-30A8AB00C526}] 2008-06-21 13:24 33792 --a------ C:\WINDOWS\system32\jkkIBUkk.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-02 22:46 13529088] "nwiz"="nwiz.exe" [2008-05-02 22:46 1630208 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-02 22:46 86016] C:\Documents and Settings\Panthro\Start Menu\Programs\Startup\ WinMySQLadmin.lnk - C:\xampp\mysql\bin\winmysqladmin.exe [2007-12-20 21:00:28 936448] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{0F8F84CF-DCBA-4426-AC18-30A8AB00C526}"= C:\WINDOWS\system32\jkkIBUkk.dll [2008-06-21 13:24 33792] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkIBUkk] jkkIBUkk.dll 2008-06-21 13:24 33792 C:\WINDOWS\system32\jkkIBUkk.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll 2008-01-09 12:30 72208 c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Panthro^Start Menu^Programs^Startup^MagicDisc.lnk] path=C:\Documents and Settings\Panthro\Start Menu\Programs\Startup\MagicDisc.lnk backup=C:\WINDOWS\pss\MagicDisc.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt] --a------ 2008-04-16 08:57 262401 C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent] --a------ 2007-09-06 08:08 136136 C:\Program Files\DAEMON Tools Pro\DTProAgent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hard Disk Sentinel] --a------ 2007-04-21 10:47 2787328 C:\Program Files\Hard Disk Sentinel\HDSentinel.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2008-05-02 22:46 13529088 C:\WINDOWS\system32\NvCpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2008-05-02 22:46 86016 C:\WINDOWS\system32\NvMcTray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2008-05-02 22:46 1630208 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] --a------ 2004-07-27 04:01 68096 C:\WINDOWS\SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-03-25 04:28 144784 C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Opera\\Opera.exe"= "C:\\3dsmax6\\3dsmax.exe"= "C:\\Program Files\\IceChat7\\IceChat7.exe"= "C:\\Program Files\\Autodesk\\3dsMax8\\3dsmax.exe"= "C:\\Program Files\\Autodesk\\backburner\\monitor.exe"= "C:\\Program Files\\Autodesk\\backburner\\manager.exe"= "C:\\Program Files\\Autodesk\\backburner\\server.exe"= "C:\\Program Files\\Poser 7\\Poser.exe"= "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"= "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Warlords\\Civ4Warlords.exe"= "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Warlords\\Civ4Warlords_PitBoss.exe"= "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword.exe"= "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword_PitBoss.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"= "C:\\Program Files\\phpDesigner 2008\\phpDesigner2008.exe"= "C:\\xampp\\apache\\bin\\apache.exe"= R0 szkg5;szkg;C:\WINDOWS\system32\DRIVERS\szkg.sys [2008-05-13 10:03] R2 Apache2.2;Apache2.2;"C:\xampp\apache\bin\apache.exe" -k runservice [] S0 OemBiosDevice;Royalty OEM BIOS Extension;C:\WINDOWS\system32\DRIVERS\royal.sys [2007-03-02 09:19] S2 XAMPP;XAMPP Service;c:\xampp\service.exe [2007-12-20 21:01] *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder "2008-06-22 23:00:08 C:\WINDOWS\Tasks\Norton Security Scan.job" - C:\Program Files\Norton Security Scan\Nss.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-23 15:37:10 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\jkkIBUkk.dll . Completion time: 2008-06-23 15:41:03 ComboFix-quarantined-files.txt 2008-06-23 20:39:49 Pre-Run: 46,501,171,200 bytes free Post-Run: 46,814,769,152 bytes free 217 --- E O F --- 2008-06-20 21:18:47