"Steven Woodcock" - 2008-11-08 13:22:11 Service Pack 3 ComboFix 07-05.27.BV - Running from: "C:\Documents and Settings\Steven Woodcock\" Command switches used :: ""C:\Documents and Settings\Steven Woodcock\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe"" ((((((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_NM -------\nm ((((((((((((((((((((((((((((((( Files Created from 2008-10-08 to 2008-11-08 )))))))))))))))))))))))))))))))))) 2008-11-07 23:24 d-------- C:\Program Files\AVG 2008-11-07 23:24 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg8 2008-11-07 22:07 d-------- C:\WINDOWS\$regcmp$ 2008-11-06 21:41 d-------- C:\WINDOWS\NV39563960.TMP 2008-10-30 18:13 d-------- C:\WINDOWS\NV38723876.TMP 2008-10-29 18:40 d-------- C:\WINDOWS\NV40724076.TMP 2008-10-29 18:08 d-------- C:\WINDOWS\NV39601916.TMP 2008-10-29 17:28 d-------- C:\WINDOWS\NV22123660.TMP 2008-10-28 17:25 d-------- C:\WINDOWS\NV30443564.TMP 2008-10-27 20:32 453,152 --a------ C:\WINDOWS\system32\nvudisp.exe 2008-10-27 20:32 d-------- C:\WINDOWS\nview 2008-10-27 20:32 d-------- C:\WINDOWS\NV35043508.TMP 2008-10-27 20:31 453,152 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2008-10-27 20:23 d-------- C:\Program Files\MultiRes 2008-10-27 20:22 d-------- C:\Program Files\Nvidia Omega Drivers 2008-10-27 19:28 d-------- C:\WINDOWS\NV38963900.TMP 2008-10-27 19:11 d-------- C:\WINDOWS\NV25522568.TMP 2008-10-27 18:05 d-------- C:\WINDOWS\NV30081300.TMP 2008-10-27 05:46 d-------- C:\WINDOWS\NV39283932.TMP 2008-10-27 04:44 d-------- C:\WINDOWS\NV40802372.TMP 2008-10-26 17:51 d-------- C:\WINDOWS\NV3484684.TMP 2008-10-25 22:23 d-------- C:\WINDOWS\NV23803976.TMP 2008-10-25 22:22 d-------- C:\NVIDIA 2008-10-14 18:58 23,552 --a------ C:\WINDOWS\system32\sstunins.exe 2008-10-14 18:58 158,208 --a------ C:\WINDOWS\system32\Space Flight Operations.scr 2008-10-11 07:02 d----c--- C:\DOCUME~1\ALLUSE~1\APPLIC~1\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185} 2008-10-11 06:47 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-10-11 06:47 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-10-11 06:47 d-------- C:\DOCUME~1\STEVEN~1\APPLIC~1\Malwarebytes 2008-10-11 06:47 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes 2008-10-10 20:03 d-------- C:\Program Files\Zamaan's Software 2008-10-10 19:47 512,688 --a------ C:\WINDOWS\system32\XceedCry.dll 2008-10-10 19:47 423,784 --a------ C:\WINDOWS\system32\XceedBkp.dll 2008-10-10 19:47 101,888 --a------ C:\WINDOWS\system32\VB6STKIT.DLL 2008-10-10 19:47 10,752 --a------ C:\WINDOWS\system32\md5.dll 2008-10-10 19:47 d-------- C:\Program Files\MalwareSweeper.com (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2008-11-08 14:42:31 -------- d-----w C:\Program Files\Windows Defender 2008-11-08 08:26:02 288 -c--a-w C:\WINDOWS\system32\DVCStateBkp-{00000003-00000000-00000001-00001102-00000002-80661102}.dat 2008-11-08 08:26:02 288 -c--a-w C:\WINDOWS\system32\DVCState-{00000003-00000000-00000001-00001102-00000002-80661102}.dat 2008-11-08 05:54:28 -------- d--h--w C:\Program Files\InstallShield Installation Information 2008-11-08 03:43:02 -------- d-----w C:\DOCUME~1\STEVEN~1\APPLIC~1\Azureus 2008-11-04 02:54:50 -------- d-----w C:\Program Files\Azureus 2008-10-28 03:22:10 737,280 ----a-w C:\WINDOWS\iun6002.exe 2008-10-11 00:36:19 -------- d-----w C:\DOCUME~1\STEVEN~1\APPLIC~1\OpenOffice.org2 2008-10-10 14:09:39 -------- d-----w C:\DOCUME~1\STEVEN~1\APPLIC~1\PreCast 2008-10-09 22:26:08 -------- d-----w C:\Program Files\Picasa2 2008-10-07 20:33:00 86,016 ----a-w C:\WINDOWS\system32\nvmctray.dll 2008-10-07 20:33:00 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll 2008-10-07 20:33:00 8,826,880 ----a-w C:\WINDOWS\system32\nvoglnt.dll 2008-10-07 20:33:00 797,216 ----a-w C:\WINDOWS\system32\nvcplui.exe 2008-10-07 20:33:00 6,133,856 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys 2008-10-07 20:33:00 475,136 ----a-w C:\WINDOWS\system32\nvapi.dll 2008-10-07 20:33:00 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll 2008-10-07 20:33:00 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll 2008-10-07 20:33:00 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe 2008-10-07 20:33:00 425,984 ----a-w C:\WINDOWS\system32\keystone.exe 2008-10-07 20:33:00 3,989,504 ----a-w C:\WINDOWS\system32\nvdisps.dll 2008-10-07 20:33:00 3,764,224 ----a-w C:\WINDOWS\system32\nvvitvs.dll 2008-10-07 20:33:00 3,444,736 ----a-w C:\WINDOWS\system32\nvgames.dll 2008-10-07 20:33:00 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll 2008-10-07 20:33:00 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll 2008-10-07 20:33:00 2,686,976 ----a-w C:\WINDOWS\system32\nvwss.dll 2008-10-07 20:33:00 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll 2008-10-07 20:33:00 163,908 ----a-w C:\WINDOWS\system32\nvsvc32.exe 2008-10-07 20:33:00 143,360 ----a-w C:\WINDOWS\system32\nvcolor.exe 2008-10-07 20:33:00 13,574,144 ----a-w C:\WINDOWS\system32\nvcpl.dll 2008-10-07 20:33:00 122,880 ----a-w C:\WINDOWS\system32\nvcodins.dll 2008-10-07 20:33:00 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll 2008-10-07 20:33:00 1,630,208 ----a-w C:\WINDOWS\system32\nwiz.exe 2008-10-07 20:33:00 1,486,848 ----a-w C:\WINDOWS\system32\nview.dll 2008-10-07 20:33:00 1,368,064 ----a-w C:\WINDOWS\system32\nvcuda.dll 2008-10-07 20:33:00 1,339,392 ----a-w C:\WINDOWS\system32\nvdspsch.exe 2008-10-07 20:33:00 1,257,472 ----a-w C:\WINDOWS\system32\nvmobls.dll 2008-10-07 20:33:00 1,019,904 ----a-w C:\WINDOWS\system32\nvwimg.dll 2008-10-07 19:33:00 6,058,112 ----a-w C:\WINDOWS\system32\nv4_disp.dll 2008-10-07 19:33:00 122,880 ----a-w C:\WINDOWS\system32\nvcod.dll 2008-10-03 16:21:38 -------- d-----w C:\Program Files\PopCap Games 2008-10-03 14:38:39 -------- d-----w C:\Program Files\MSECACHE 2008-10-01 01:21:39 -------- d-----w C:\DOCUME~1\STEVEN~1\APPLIC~1\Juniper Networks 2008-09-19 03:27:01 -------- d-----w C:\Program Files\OpenOffice.org 2.4 2008-09-17 02:37:25 -------- d-----w C:\Program Files\Coupons 2008-09-15 12:12:56 1,846,400 ----a-w C:\WINDOWS\system32\win32k.sys 2008-09-13 02:35:47 52,268 ---ha-w C:\WINDOWS\system32\mlfcache.dat 2008-09-12 02:18:14 -------- d-----w C:\DOCUME~1\STEVEN~1\APPLIC~1\NREL 2008-09-12 02:16:30 -------- d-----w C:\Program Files\NREL 2008-09-08 10:41:42 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-09-06 03:04:34 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2006-09-29 05:20:37 8 --sha-r C:\WINDOWS\system32\FE3FFDF5A4.sys 2006-09-29 05:20:37 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}=C:\Program Files\AVG\AVG8\avgssie.dll [] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 03:27] {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}=C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll [2008-10-16 17:17] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 16:24] "nwiz"="nwiz.exe" [2008-10-07 13:33 C:\WINDOWS\system32\nwiz.exe] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 17:12] "Malware Sweeper"="C:\Program Files\MalwareSweeper.com\MalwareSweeper\MalSwep.exe" [2007-11-11 15:20] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "ClearRecentDocsOnExit"=01000000 "NoBandCustomize"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy] %SystemRoot%\System32\dimsntfy.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PreCast Monitor.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PreCast Monitor.lnk backup=C:\WINDOWS\pss\PreCast Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Steven Woodcock^Start Menu^Programs^Startup^1st QuickRes.lnk] path=C:\Documents and Settings\Steven Woodcock\Start Menu\Programs\Startup\1st QuickRes.lnk backup=C:\WINDOWS\pss\1st QuickRes.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Steven Woodcock^Start Menu^Programs^Startup^GBPVRTray.exe.lnk] path=C:\Documents and Settings\Steven Woodcock\Start Menu\Programs\Startup\GBPVRTray.exe.lnk backup=C:\WINDOWS\pss\GBPVRTray.exe.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Steven Woodcock^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk] path=C:\Documents and Settings\Steven Woodcock\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk backup=C:\WINDOWS\pss\OpenOffice.org 2.4.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Launchpad] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BHR] C:\Program Files\Zamaan's Software\Browser Hijack Retaliator 4.5\BHR.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer] Mixer.exe /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DT HPW] C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe -startup_folder [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\flockbox] D:\Apps\My Lockbox\flockbox.exe /a [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malware Sweeper] C:\Program Files\MalwareSweeper.com\MalwareSweeper\MalSwep.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg] C:\WINDOWS\UpdReg.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "ccPwdSvc"=3 (0x3) "ccEvtMgr"=2 (0x2) "iPodService"=3 (0x3) "WmdmPmSN"=3 (0x3) "WebClient"=2 (0x2) "VSS"=3 (0x3) "UPS"=3 (0x3) "UPHClean"=2 (0x2) "UleadBurningHelper"=2 (0x2) "TrkWks"=2 (0x2) "TermService"=3 (0x3) "TapiSrv"=3 (0x3) "SysmonLog"=2 (0x2) "SwPrv"=3 (0x3) "SQLWriter"=2 (0x2) "WZCSVC"=2 (0x2) "wuauserv"=2 (0x2) "upnphost"=2 (0x2) "SCardSvr"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] eapsvcs eaphost dot3svc dot3svc HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs* napagent [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8429d986-106e-11db-8e22-00502c08af8e}] AutoRun\command- F:\LaunchU3.exe Contents of the 'Scheduled Tasks' folder 2008-11-08 19:46:53 C:\WINDOWS\tasks\MP Scheduled Scan.job ******************************************************************** catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-08 01:28:13 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... disk error: C:\WINDOWS\ please note that you need administrator rights to perform deep scan ******************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\TDSSserv] "imagepath"="\systemroot\system32\drivers\TDSSserv.sys" Completion time: 2008-11-08 1:30:37 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2008-11-08 01:30 --- E O F ---