ComboFix 08-01-31.3 - Administrator 2008-01-31 8:36:11.1 - NTFSx86 NETWORK Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1044.18.67 [GMT 1:00] Running from: C:\Documents and Settings\[removed]\Skrivebord\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Wenche\err.log C:\Documents and Settings\Wenche\Programdata\DriveCleaner 2006 Free C:\Documents and Settings\Wenche\Programdata\DriveCleaner 2006 Free\Logs\update.log C:\Documents and Settings\Wenche\Programdata\storageprotector C:\Documents and Settings\Wenche\Programdata\storageprotector\Logs\update.log C:\Programfiler\StorageProtector C:\Programfiler\StorageProtector\License.rtf C:\Programfiler\StorageProtector\Readme.rtf C:\Programfiler\StorageProtector\rm.url C:\Programfiler\StorageProtector\sr.log C:\Programfiler\StorageProtector\swupd.log C:\Programfiler\StorageProtector\SysRep.exe.cer C:\Programfiler\StorageProtector\SysRep.exe.Log C:\Programfiler\StorageProtector\SysRep.exe.xml C:\Programfiler\StorageProtector\SysRep.url C:\Programfiler\StorageProtector\unins000.dat C:\WINDOWS\images.zip C:\WINDOWS\system32\cbcfe.ini C:\WINDOWS\system32\cbcfe.ini2 C:\WINDOWS\system32\cisckcvg.ini C:\WINDOWS\system32\gvckcsic.dll C:\WINDOWS\system32\jfhbgonr.dll C:\WINDOWS\system32\jfhbgonr.dllbox C:\WINDOWS\system32\jjbimrlk.dllbox C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\opppq.dll C:\WINDOWS\system32\qpppo.ini C:\WINDOWS\system32\qpppo.ini2 C:\WINDOWS\system32\tfcjdlgp.dll C:\WINDOWS\system32\tobbjvmy.dll C:\WINDOWS\system32\xxyywwu.dll C:\WINDOWS\system32\ymvjbbot.ini . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_DOMAINSERVICE ((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-31 ))))))))))))))))))))))))))))))) . 2008-01-30 22:15 . 2008-01-30 23:35 d-------- C:\WINDOWS\BDOSCAN8 2008-01-30 22:11 . 2008-01-30 22:11 d---s---- C:\Documents and Settings\Administrator\UserData 2008-01-30 20:50 . 2008-01-30 20:50 d-------- C:\Documents and Settings\Administrator\Programdata\TuneUp Software 2008-01-30 19:34 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2008-01-30 19:34 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2008-01-30 19:34 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2008-01-30 19:34 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2008-01-30 19:33 . 2008-01-30 19:33 d-------- C:\Programfiler\Alwil Software 2008-01-30 19:33 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe 2008-01-30 19:33 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2008-01-30 19:33 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2008-01-30 19:33 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2008-01-30 19:28 . 2003-05-04 06:15 dr------- C:\Documents and Settings\Administrator\Start-meny 2008-01-30 19:28 . 2003-05-04 06:15 d--h----- C:\Documents and Settings\Administrator\Skrivere 2008-01-30 19:28 . 2008-01-31 08:42 d-------- C:\Documents and Settings\Administrator\Skrivebord 2008-01-30 19:28 . 2008-01-30 20:34 dr-h----- C:\Documents and Settings\Administrator\Siste 2008-01-30 19:28 . 2003-05-03 23:26 d-------- C:\Documents and Settings\Administrator\Programdata\Symantec 2008-01-30 19:28 . 2003-05-03 22:51 d-------- C:\Documents and Settings\Administrator\Programdata\Sonic 2008-01-30 19:28 . 2003-05-03 23:35 d-------- C:\Documents and Settings\Administrator\Programdata\Share-to-Web-opplastingsmappe 2008-01-30 19:28 . 2008-01-30 22:09 dr-h----- C:\Documents and Settings\Administrator\Programdata 2008-01-30 19:28 . 2008-01-31 08:37 dr------- C:\Documents and Settings\Administrator\Mine dokumenter 2008-01-30 19:28 . 2003-05-04 06:15 d--h----- C:\Documents and Settings\Administrator\Maler 2008-01-30 19:28 . 2008-01-31 08:43 d--h----- C:\Documents and Settings\Administrator\Lokale innstillinger 2008-01-30 19:28 . 2003-05-04 06:15 dr------- C:\Documents and Settings\Administrator\Favoritter 2008-01-30 19:28 . 2003-05-04 06:15 d--h----- C:\Documents and Settings\Administrator\AndrMask 2008-01-30 18:39 . 2008-01-30 18:39 dr-h----- C:\Documents and Settings\Wenche\Siste 2008-01-30 17:27 . 2008-01-30 17:27 d-------- C:\Programfiler\CCleaner 2008-01-29 22:48 . 2008-01-29 22:48 d-------- C:\Documents and Settings\Wenche\Programdata\TuneUp Software 2008-01-29 22:47 . 2008-01-29 22:47 d-------- C:\Documents and Settings\All Users\Programdata\TuneUp Software 2008-01-29 22:47 . 2007-05-16 09:41 29,704 --a------ C:\WINDOWS\system32\uxtuneup.dll 2008-01-29 22:46 . 2008-01-29 22:48 d-------- C:\Programfiler\TuneUp Utilities 2007 2008-01-29 22:45 . 2008-01-29 22:45 d-------- C:\Programfiler\Fellesfiler\Wise Installation Wizard 2008-01-28 18:34 . 2008-01-29 21:37 d-------- C:\Documents and Settings\Maikenpii\Programdata\LimeWire 2008-01-28 18:04 . 2008-01-28 18:04 d-------- C:\Documents and Settings\Maikenpii\Programdata\DivX 2008-01-28 16:48 . 2008-01-28 16:49 d-------- C:\Documents and Settings\Maikenpii\Contacts 2008-01-28 16:48 . 2008-01-28 16:48 268 --ah----- C:\sqmdata00.sqm 2008-01-28 16:48 . 2008-01-28 16:48 244 --ah----- C:\sqmnoopt07.sqm 2008-01-28 16:46 . 2008-01-28 16:46 d-------- C:\Documents and Settings\Maikenpii\Programdata\Creative 2008-01-28 16:44 . 2003-05-04 06:15 dr------- C:\Documents and Settings\Maikenpii\Start-meny 2008-01-28 16:44 . 2003-05-04 06:15 d--h----- C:\Documents and Settings\Maikenpii\Skrivere 2008-01-28 16:44 . 2008-01-28 19:23 d-------- C:\Documents and Settings\Maikenpii\Skrivebord 2008-01-28 16:44 . 2008-01-29 21:37 dr-h----- C:\Documents and Settings\Maikenpii\Siste 2008-01-28 16:44 . 2003-05-03 23:26 d-------- C:\Documents and Settings\Maikenpii\Programdata\Symantec 2008-01-28 16:44 . 2003-05-03 22:51 d-------- C:\Documents and Settings\Maikenpii\Programdata\Sonic 2008-01-28 16:44 . 2003-05-03 23:35 d-------- C:\Documents and Settings\Maikenpii\Programdata\Share-to-Web-opplastingsmappe 2008-01-28 16:44 . 2008-01-28 18:34 dr-h----- C:\Documents and Settings\Maikenpii\Programdata 2008-01-28 16:44 . 2008-01-31 08:37 dr------- C:\Documents and Settings\Maikenpii\Mine dokumenter 2008-01-28 16:44 . 2003-05-04 06:15 d--h----- C:\Documents and Settings\Maikenpii\Maler 2008-01-28 16:44 . 2003-05-04 06:15 d--h----- C:\Documents and Settings\Maikenpii\Lokale innstillinger 2008-01-28 16:44 . 2008-01-28 16:45 dr------- C:\Documents and Settings\Maikenpii\Favoritter 2008-01-28 16:44 . 2003-05-04 06:15 d--h----- C:\Documents and Settings\Maikenpii\AndrMask 2008-01-28 16:27 . 2008-01-28 16:27 d-------- C:\Documents and Settings\Wenche\Programdata\HP 2008-01-28 16:27 . 2008-01-28 16:27 d-------- C:\Documents and Settings\Wenche\Programdata\Common Files 2008-01-25 15:04 . 2008-01-25 15:05 354,816 --a------ C:\WINDOWS\RBossing05.exe 2008-01-21 19:19 . 2008-01-21 19:19 48 --a------ C:\tmp.bat 2008-01-14 22:26 . 2008-01-28 01:18 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-01-14 22:26 . 2008-01-14 22:26 1,409 --a------ C:\WINDOWS\QTFont.for 2008-01-09 15:01 . 2008-01-09 15:01 53,248 --a------ C:\WINDOWS\bdoscandel.exe 2008-01-09 15:01 . 2008-01-09 15:01 453 --a------ C:\WINDOWS\bdoscandellang.ini 2008-01-07 23:03 . 2008-01-07 23:03 d-------- C:\Programfiler\BearShare Applications 2008-01-07 23:03 . 2006-11-12 11:39 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx 2007-12-28 21:58 . 2008-01-15 18:48 d-------- C:\Programfiler\StepMania 2007-12-28 20:52 . 2008-01-30 21:08 7 --a------ C:\WINDOWS\system32\ANIWZCSUSERNAME 2007-12-28 20:46 . 2007-12-28 20:46 3,284 --a------ C:\WINDOWS\system32\ANIWZCS{E122442F-4D48-49BD-9E2A-C34F1604040C} 2007-12-28 20:44 . 2008-01-29 17:45 7 --a------ C:\WINDOWS\system32\ANIWZCSUSERNAME{E122442F-4D48-49BD-9E2A-C34F1604040C} 2007-12-28 20:43 . 2007-12-28 20:43 d-------- C:\Programfiler\ANI 2007-12-28 20:42 . 2007-12-28 20:42 d-------- C:\Programfiler\D-Link 2007-12-28 20:42 . 2007-03-13 12:35 476,416 --a------ C:\WINDOWS\system32\drivers\rt2870.sys 2007-12-28 20:40 . 2007-12-28 20:40 d-------- C:\Documents and Settings\Wenche\Programdata\InstallShield 2007-12-19 20:42 . 2007-12-19 20:42 d-------- C:\f1741e191bcbe7fe20d5 2007-12-03 18:54 . 2007-12-03 18:54 d-------- C:\Documents and Settings\Wenche\Programdata\GanymedeNet 2007-12-03 18:54 . 2007-12-03 18:54 4 --a------ C:\WINDOWS\system32\proc-1963933865.bin . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-30 20:04 --------- d-----w C:\Programfiler\F-secure 2008-01-30 20:02 --------- d-----w C:\Programfiler\Yahoo! 2008-01-27 20:40 --------- d-----w C:\Documents and Settings\Wenche\Programdata\LimeWire 2007-12-28 19:43 --------- d--h--w C:\Programfiler\InstallShield Installation Information 2007-11-29 17:16 --------- d-----w C:\Programfiler\Windows Live 2007-11-29 16:54 --------- dcsh--w C:\Programfiler\Fellesfiler\WindowsLiveInstaller 2007-11-29 16:44 --------- d-----w C:\Documents and Settings\All Users\Programdata\WLInstaller 2006-08-29 13:12 30,432 -c--a-w C:\Documents and Settings\Wenche\Programdata\GDIPFONTCACHEV1.DAT 2007-06-13 13:24 354,816 --sh--r C:\WINDOWS\system32\sysregi.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02d902bb-a1b8-42d8-a565-810b0447e486}] C:\WINDOWS\system32\tefpmels.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4D8746B8-49D3-4262-AFB5-5591B778ED78}] C:\WINDOWS\system32\efcbc.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:03 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-10-30 09:46 155648] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-10-30 09:33 118784] "SunJavaUpdateSched"="C:\Programfiler\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 02:48 36975] "SynTPLpr"="C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe" [2004-05-26 18:15 98304] "HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2003-05-22 18:58 483328] "iTunesHelper"="C:\Programfiler\iTunes\iTunesHelper.exe" [2005-12-20 19:54 278528] "ANIWZCS2Service"="C:\Programfiler\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2007-01-19 11:49 49152] "eabconfg.cpl"="C:\Programfiler\HPQ\Quick Launch Buttons\EabServr.exe" [2004-04-30 12:50 274432] "D-Link D-Link Wireless N DWA-140"="C:\Programfiler\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe" [2007-03-14 18:29 1388544] "Cpqset"="C:\Programfiler\HPQ\Default Settings\cpqset.exe" [2004-04-30 09:32 208958] "HP Software Update"="C:\Programfiler\HP\HP Software Update\HPWuSchd.exe" [2003-06-25 10:24 49152] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 09:03 15360] C:\Documents and Settings\All Users\Start-meny\Programmer\Oppstart\ Microsoft Office.lnk - C:\Programfiler\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run] "NTSpool"= NTSpool.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "TkBellExe"="C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" -osboot HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Contents of the 'Scheduled Tasks' folder "2008-01-29 21:48:13 C:\WINDOWS\Tasks\1-Click Maintenance.job" - C:\Programfiler\TuneUp Utilities 2007\SystemOptimizer.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-31 09:26:50 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = C:\Programfiler\HPQ\Default Settings\cpqset.exe?????????8?1?9?6??P???? ???B???????????????B???????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Programfiler\Alwil Software\Avast4\aswUpdSv.exe C:\Programfiler\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\wdfmgr.exe C:\Programfiler\Alwil Software\Avast4\ashMaiSv.exe C:\Programfiler\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\System32\hkcmd.exe C:\Programfiler\Java\jre1.5.0_03\bin\jusched.exe C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe C:\WINDOWS\System32\hphmon05.exe C:\Programfiler\iTunes\iTunesHelper.exe C:\Programfiler\ANI\ANIWZCS2 Service\WZCSLDR2.exe C:\Programfiler\HPQ\Quick Launch Buttons\EabServr.exe C:\Programfiler\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe C:\Programfiler\iPod\bin\iPodService.exe C:\Programfiler\HP\HP Software Update\HPWuSchd.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Programfiler\HPQ\SHARED\HPQWMI.exe . ************************************************************************** . Completion time: 2008-01-31 9:30:46 - machine was rebooted [Wenche] ComboFix-quarantined-files.txt 2008-01-31 08:30:38 . 2008-01-09 08:53:55 --- E O F ---