ComboFix 08-08-29.02 - Flor Mill 2008-08-30 13:12:10.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.184 [GMT 5.5:30] Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\[u]0[/u]E865262B7.dll C:\WINDOWS\system32\kr_done1 . ((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-30 ))))))))))))))))))))))))))))))) . 2008-08-28 19:23 . 2004-08-04 06:00 1,032,192 --a--c--- C:\WINDOWS\system32\dllcache\explorer.exe 2008-08-28 19:23 . 2004-08-04 06:00 1,032,192 --a------ C:\WINDOWS\explorer.exe 2008-08-28 18:25 . 2008-04-13 17:12 116,224 --a--c--- C:\WINDOWS\system32\dllcache\xrxwiadr.dll 2008-08-28 18:25 . 2001-08-17 22:37 27,648 --a--c--- C:\WINDOWS\system32\dllcache\xrxftplt.exe 2008-08-28 18:25 . 2001-08-17 22:36 23,040 --a--c--- C:\WINDOWS\system32\dllcache\xrxwbtmp.dll 2008-08-28 18:25 . 2008-04-13 17:12 18,944 --a--c--- C:\WINDOWS\system32\dllcache\xrxscnui.dll 2008-08-28 18:25 . 2001-08-17 22:37 4,608 --a--c--- C:\WINDOWS\system32\dllcache\xrxflnch.exe 2008-08-28 18:23 . 2001-08-17 13:28 794,654 --a--c--- C:\WINDOWS\system32\dllcache\usr1801.sys 2008-08-28 18:22 . 2001-08-17 14:56 440,576 --a--c--- C:\WINDOWS\system32\dllcache\tridkb.dll 2008-08-28 18:21 . 2001-08-17 22:36 495,616 --a--c--- C:\WINDOWS\system32\dllcache\sblfx.dll 2008-08-28 18:20 . 2001-08-17 13:28 899,146 --a--c--- C:\WINDOWS\system32\dllcache\r2mdkxga.sys 2008-08-28 18:19 . 2008-04-13 11:31 2,065,792 --a--c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2008-08-28 18:18 . 2001-08-17 12:50 320,384 --a--c--- C:\WINDOWS\system32\dllcache\mgaum.sys 2008-08-28 18:17 . 2001-08-17 13:28 802,683 --a--c--- C:\WINDOWS\system32\dllcache\ltsm.sys 2008-08-28 18:16 . 2008-04-13 17:11 702,845 --a--c--- C:\WINDOWS\system32\dllcache\i81xdnt5.dll 2008-08-28 18:15 . 2001-08-17 14:56 1,733,120 --a--c--- C:\WINDOWS\system32\dllcache\g400d.dll 2008-08-28 18:14 . 2001-08-17 13:28 634,134 --a--c--- C:\WINDOWS\system32\dllcache\el656ct5.sys 2008-08-28 18:13 . 2001-08-17 12:14 952,007 --a--c--- C:\WINDOWS\system32\dllcache\diwan.sys 2008-08-28 18:12 . 2001-08-17 12:13 980,034 --a--c--- C:\WINDOWS\system32\dllcache\cicap.sys 2008-08-28 18:11 . 2001-08-17 13:28 871,388 --a--c--- C:\WINDOWS\system32\dllcache\bcmdm.sys 2008-08-28 18:10 . 2008-04-13 12:27 2,188,928 --a--c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2008-08-28 18:10 . 2001-08-17 14:56 66,048 --a--c--- C:\WINDOWS\system32\dllcache\s3legacy.dll 2008-08-28 13:35 . 2008-08-28 13:35 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-08-28 13:31 . 2008-08-28 13:34 d-------- C:\Documents and Settings\Administrator 2008-08-28 12:20 . 2008-08-28 12:20 d-------- C:\Program Files\Lavasoft 2008-08-28 12:20 . 2008-08-28 12:44 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-08-26 14:45 . 2008-08-26 14:53 d-------- C:\Documents and Settings\All Users\Application Data\Protexis 2008-08-26 14:43 . 1998-04-24 00:00 368,912 --a------ C:\WINDOWS\system32\vbar332.dll 2008-08-26 14:43 . 2001-03-13 14:49 140,288 --a------ C:\WINDOWS\system32\COMDLG32.OCX 2008-08-26 14:15 . 2008-08-26 14:15 d-------- C:\Program Files\Trend Micro 2008-08-25 20:20 . 2008-08-25 20:21 2 --a------ C:\2017259342 2008-08-25 19:55 . 2008-08-25 19:55 d--h----- C:\WINDOWS\PIF 2008-08-25 19:45 . 2008-08-25 19:45 d-------- C:\Program Files\BinaryBiz 2008-08-25 19:42 . 2008-08-25 19:42 d-------- C:\Downloads 2008-08-25 19:42 . 2008-08-25 19:43 d-------- C:\Documents and Settings\Flor Mill\Application Data\GetRightToGo 2008-08-25 18:30 . 2008-08-25 18:48 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-08-25 13:51 . 2008-08-25 19:35 d-------- C:\Program Files\PowerDataRecovery 2008-08-25 12:53 . 2008-08-25 12:53 d-------- C:\Program Files\uTorrent 2008-08-25 12:53 . 2008-08-28 13:35 d-------- C:\Documents and Settings\Flor Mill\Application Data\uTorrent 2008-08-23 14:54 . 2008-08-23 15:05 d-------- C:\WINDOWS\system32\Adobe 2008-08-23 14:54 . 2008-08-23 14:55 681 --a------ C:\WINDOWS\mozver.dat 2008-08-22 14:31 . 2008-08-22 14:31 d-------- C:\Program Files\CCleaner 2008-08-22 13:25 . 2008-08-22 14:30 d-------- C:\Documents and Settings\All Users\Symantec Temporary Files 2008-08-22 12:45 . 2008-08-22 12:45 d-------- C:\Documents and Settings\Flor Mill\Application Data\Symantec 2008-08-22 12:43 . 2008-08-22 12:43 d-------- C:\Program Files\Windows Sidebar 2008-08-22 12:42 . 2008-08-22 12:44 d-------- C:\Program Files\Norton Internet Security 2008-08-22 12:42 . 2008-08-22 13:05 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-08-22 12:42 . 2008-08-22 13:05 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2008-08-22 12:42 . 2008-08-22 13:05 10,671 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-08-22 12:42 . 2008-08-22 13:05 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-08-22 12:41 . 2008-08-22 13:05 d-------- C:\Program Files\Symantec 2008-08-22 12:41 . 2008-08-30 13:08 d-------- C:\Program Files\Common Files\Symantec Shared 2008-08-05 12:08 . 2008-08-05 12:08 d-------- C:\WINDOWS\Sun 2008-08-05 12:08 . 2008-06-10 15:02 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-08-05 12:07 . 2008-08-05 12:08 d-------- C:\Program Files\Java 2008-08-05 11:56 . 2008-08-05 11:56 d-------- C:\Program Files\Common Files\Java 2008-07-28 14:52 . 2008-07-28 14:52 d-------- C:\Documents and Settings\Flor Mill\Application Data\Uniblue 2008-07-28 14:33 . 2008-07-28 14:33 d-------- C:\WINDOWS\system32\scripting 2008-07-28 14:33 . 2008-07-28 14:33 d-------- C:\WINDOWS\system32\en 2008-07-28 14:33 . 2008-07-28 14:33 d-------- C:\WINDOWS\system32\bits 2008-07-28 14:33 . 2008-07-28 14:33 d-------- C:\WINDOWS\l2schemas 2008-07-28 14:30 . 2008-07-28 14:34 d-------- C:\WINDOWS\ServicePackFiles 2008-07-24 19:07 . 2008-04-14 05:42 4,274,816 --------- C:\WINDOWS\system32\nv4_disp.dll 2008-07-24 19:06 . 2008-04-14 05:42 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\smtpsnap.dll 2008-07-24 13:53 . 2008-07-24 13:53 d-------- C:\Program Files\MSXML 4.0 2008-07-24 13:06 . 2008-08-18 12:23 d--h----- C:\WINDOWS\$hf_mig$ 2008-07-24 12:36 . 2008-07-24 12:36 d--hs---- C:\Documents and Settings\Flor Mill\UserData 2008-07-24 00:49 . 2007-04-16 07:18 92,399 --a------ C:\WINDOWS\VGAsetup.ini 2008-07-24 00:48 . 2008-07-24 00:48 d-------- C:\WINDOWS\SIS 2008-07-24 00:48 . 2008-07-24 00:57 d-------- C:\Program Files\SiS VGA Utilities V3.80 2008-07-24 00:48 . 2007-04-11 15:35 262,144 --a------ C:\WINDOWS\system32\sistray.exe 2008-07-24 00:48 . 2008-07-24 00:57 254,471 --a------ C:\WINDOWS\system32\VGAunistlog.ini 2008-07-24 00:48 . 2006-04-13 16:05 208,896 --a------ C:\WINDOWS\Progress.exe 2008-07-24 00:48 . 2007-04-11 23:34 135,168 --------- C:\WINDOWS\system32\SiSApCom.dll 2008-07-24 00:48 . 2007-04-11 23:36 110,592 --------- C:\WINDOWS\system32\TVMode.dll 2008-07-24 00:48 . 2007-04-11 23:36 65,536 --------- C:\WINDOWS\system32\SiSHook.dll 2008-07-24 00:48 . 2007-04-11 23:36 53,248 --a------ C:\WINDOWS\system32\SiSPower.dll 2008-07-24 00:48 . 2006-04-29 06:26 49,152 --a------ C:\WINDOWS\InstFunc.exe 2008-07-24 00:48 . 2007-04-11 23:35 12,288 --a------ C:\WINDOWS\InstFunc.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-23 08:15 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-23 08:15 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-08-23 07:20 --------- d-----w C:\Program Files\Common Files\Adobe 2008-08-23 07:18 --------- d-----w C:\Documents and Settings\Flor Mill\Application Data\AdobeUM 2008-08-22 07:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-07-30 12:12 23,888 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys 2008-07-30 11:58 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf 2008-07-30 11:58 10,537 ----a-w C:\WINDOWS\system32\drivers\coh_mon.cat 2008-07-23 19:27 --------- d-----w C:\Program Files\sisagp 2008-07-18 16:40 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 16:40 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 16:40 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 16:40 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 16:39 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 16:39 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 16:39 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 16:39 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:43 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-13 09:15 579,464 ----a-w C:\WINDOWS\system32\SymNeti.dll 2008-06-13 09:15 207,240 ----a-w C:\WINDOWS\system32\SymRedir.dll 2008-05-16 06:28 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe 2008-05-09 10:53 90,112 ----a-w C:\WINDOWS\system32\wshext.dll 2008-05-09 10:53 430,080 ----a-w C:\WINDOWS\system32\vbscript.dll 2008-05-09 10:53 180,224 ----a-w C:\WINDOWS\system32\scrobj.dll 2008-05-09 10:53 172,032 ----a-w C:\WINDOWS\system32\scrrun.dll 2008-05-08 11:24 155,648 ----a-w C:\WINDOWS\system32\wscript.exe 2008-05-07 09:07 135,168 ----a-w C:\WINDOWS\system32\cscript.exe 2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 05:42 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-03-17 03:36 868352] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 16:57 144784] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-26 07:17 51048] "osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2008-02-07 12:19 718704] "SiSPower"="SiSPower.dll" [2007-04-11 23:36 53248 C:\WINDOWS\system32\SiSPower.dll] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 05:42 15360] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-05-15 08:36:14 113664] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696] Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2008-07-24 00:48:54 262144] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.yv12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winim15.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winlp27.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winrv83.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winsw48.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wintx15.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winxc26.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-10-15 22:44 202024 C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-02 04:27 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "E:\\tally7.2\\tally72.exe"= "C:\\WINDOWS\\system32\\CNAB4RPK.EXE"= "C:\\Tally\\tally9.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-01-26 07:17] R2 Tally License Server;Tally License Server (NT);C:\Tally\tallylicserver.exe [2006-12-13 04:34] S0 Winim15;Winim15;C:\WINDOWS\system32\Drivers\Winim15.sys [] S0 Winlp27;Winlp27;C:\WINDOWS\system32\Drivers\Winlp27.sys [] S0 Winrv83;Winrv83;C:\WINDOWS\system32\Drivers\Winrv83.sys [] S0 Winsw48;Winsw48;C:\WINDOWS\system32\Drivers\Winsw48.sys [] S0 Wintx15;Wintx15;C:\WINDOWS\system32\Drivers\Wintx15.sys [] S0 Winxc26;Winxc26;C:\WINDOWS\system32\Drivers\Winxc26.sys [] S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-07-30 17:42] *Newly Created Service* - CATCHME *Newly Created Service* - COMHOST *Newly Created Service* - PROCEXP90 . Contents of the 'Scheduled Tasks' folder 2008-08-25 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Flor Mill.job - C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2008-02-07 19:35] . - - - - ORPHANS REMOVED - - - - MSConfigStartUp-LHotkey - LHotkey.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Flor Mill\Application Data\Mozilla\Firefox\Profiles\unw0qkzz.default\ FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-30 13:13:50 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-30 13:15:47 ComboFix-quarantined-files.txt 2008-08-30 07:45:25 Pre-Run: 12,931,842,048 bytes free Post-Run: 13,377,892,352 bytes free 224 --- E O F --- 2008-08-28 13:55:41