ComboFix 07-06-09.5 - C:\Documents and Settings\User\My Documents\Downloads\ComboFix.exe
"User" - 2007-06-11 17:44:25 - Service Pack 2 NTFS
Command switches used :: C:\Documents and Settings\User\Desktop\ComboFix-Do.txt
((((((((((((((((((((((((( Files Created from 2007-05-12 to 2007-06-12 )))))))))))))))))))))))))))))))
2007-06-10 18:17 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-06-09 22:44 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-09 22:24 <DIR> d-------- C:\DOCUME~1\User\APPLIC~1\Jetico Personal Firewall
2007-06-09 22:20 <DIR> d-------- C:\Program Files\Jetico
2007-06-06 20:00 1,040,384 --a------ C:\WINDOWS\system32\libeay32.dll
2007-06-06 19:58 196,608 --a------ C:\WINDOWS\system32\ssleay32.dll
2007-06-04 19:05 <DIR> d-------- C:\VundoFix Backups
2007-06-03 14:46 <DIR> d-------- C:\DOCUME~1\User\APPLIC~1\Lavasoft
2007-06-03 14:40 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-06-03 14:40 <DIR> d-------- C:\Program Files\Your Uninstaller 2006
2007-06-03 14:40 <DIR> d-------- C:\DOCUME~1\User\APPLIC~1\URSoft
2007-06-03 12:18 <DIR> d-------- C:\Program Files\IMSIDesign
2007-06-03 12:18 <DIR> d-------- C:\DOCUME~1\User\APPLIC~1\IMSIDesign
2007-06-03 12:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\IMSIDesign
2007-06-02 23:14 7,864,320 --a------ C:\DOCUME~1\User\ntuser.dat
2007-06-01 19:19 921,600 --a------ C:\WINDOWS\system32\vorbisenc.dll
2007-06-01 19:19 237,568 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-06-01 19:19 237,568 --a------ C:\WINDOWS\system32\OggDS.dll
2007-06-01 19:19 1,216,512 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-06-01 19:19 <DIR> d-------- C:\TempDVD
2007-06-01 19:19 <DIR> d-------- C:\Program Files\dvdSanta
2007-06-01 19:19 <DIR> d-------- C:\dvdsanta
2007-06-01 08:02 395,776 --a------ C:\WINDOWS\system32\libmplayer.dll
2007-06-01 08:02 262,144 --a------ C:\WINDOWS\system32\TomsMoComp_ff.dll
2007-06-01 08:02 2,255,360 --a------ C:\WINDOWS\system32\libavcodec.dll
2007-06-01 08:02 112,640 --a------ C:\WINDOWS\system32\libmpeg2_ff.dll
2007-06-01 08:02 <DIR> d-------- C:\Program Files\Cucusoft
2007-06-01 08:02 <DIR> d-------- C:\ConverterOutput
2007-05-31 18:57 <DIR> d-------- C:\Program Files\WebEx
2007-05-31 18:57 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sage Software
2007-05-31 18:51 <DIR> d-------- C:\Program Files\Common Files\AnswerWorks 5.0
2007-05-31 18:50 40,448 --------- C:\WINDOWS\system32\dsofile.dll
2007-05-31 18:49 <DIR> d-------- C:\Program Files\Simply Accounting Pro 2007
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-06-11 01:08:54 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-06-11 01:06:29 -------- d-----w C:\Program Files\NoAdware3
2007-06-10 05:16:23 -------- d-----w C:\Program Files\Norton SystemWorks
2007-06-08 03:40:35 -------- d-----w C:\Program Files\SpywareBlaster
2007-06-08 00:55:41 -------- d-----w C:\DOCUME~1\User\APPLIC~1\uTorrent
2007-06-06 01:58:26 -------- d-----w C:\Program Files\Payroll
2007-06-03 21:46:39 -------- d-----w C:\Program Files\Lavasoft
2007-06-03 21:45:07 -------- d-----w C:\Program Files\XoftSpy
2007-06-03 20:33:18 -------- d-----w C:\Program Files\TopDownloads_WhenUSave_Installer
2007-06-03 18:19:00 -------- d-----w C:\Program Files\uTorrent
2007-06-03 18:18:59 -------- d-----w C:\Program Files\Mouse
2007-06-03 18:07:50 -------- d-----w C:\Program Files\caseware2005
2007-06-01 01:50:31 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-04-30 15:41:55 85,952 -c--a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-04-30 15:41:42 94,552 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-04-30 15:39:41 23,416 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-04-30 15:38:51 43,176 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-04-30 15:37:23 26,888 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-04-28 18:47:08 -------- d-----w C:\Program Files\winsim85
2007-04-23 05:09:54 188,416 ----a-w C:\WINDOWS\system32\vorbis.dll
2007-04-23 05:09:26 45,056 ----a-w C:\WINDOWS\system32\ogg.dll
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-17 05:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-17 05:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 05:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-17 05:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-17 05:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 05:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 05:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 05:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-03-17 13:43:01 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 17:39]
{1B041C3A-2697-47D1-A0A5-2DDFEBCC96B6}=C:\WINDOWS\system32\vtstu.dll []
{47057EFC-2DD2-475A-A41B-BF74B05A5319}=C:\WINDOWS\system32\jkklj.dll []
{B2DEC5DB-BB0B-44DA-9961-B8C0600761C8}=C:\WINDOWS\system32\vtsqo.dll []
{F5E924A5-3D05-4652-BB2F-EF3478A393F6}=C:\WINDOWS\system32\ssttr.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WheelMouse"="C:\Program Files\Mouse\Amoumain.exe" [2003-01-07 18:55]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-06-26 18:36]
"CARPService"="carpserv.exe" [2003-01-09 13:42 C:\WINDOWS\system32\carpserv.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 08:42]
"nwiz"="nwiz.exe" [2002-11-18 15:15 C:\WINDOWS\system32\nwiz.exe]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-07-10 11:29]
"JeticoPFStartup"="C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe" [2005-07-18 23:22]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cacheman"="C:\PROGRA~1\Cacheman\Cacheman.exe" [2002-02-10 11:50]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 05:29]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸K0¨4W]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸K0¨4W]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸K0¨4W]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸K0¨4W]
C:\WINDOWS\wrqewmob.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ewido security suite control"=2 (0x2)
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
Contents of the 'Scheduled Tasks' folder
2007-06-09 03:00:00 C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer.job
2005-06-13 17:02:32 C:\WINDOWS\tasks\XoftSpy.job
**************************************************************************
catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-06-11 17:47:12
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
cmd.exe [2012]
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
Completion time: 2007-06-11 17:48:12
C:\ComboFix-quarantined-files.txt ... 2007-06-11 17:47
--- E O F ---
Incident Status Location
Virus:Trj/Mitglieder.DC!CME-766 Disinfected C:\Documents and Settings\User\Application Data\Mozilla\Profiles\default\msd3o7pi.slt\Mail\pop.uniserve.com\Inbox[6.zip][01_05_2005.exe]
Virus:Trj/Mitglieder.DC!CME-766 Disinfected C:\Documents and Settings\User\Application Data\Mozilla\Profiles\default\msd3o7pi.slt\Mail\pop.uniserve.com\Trash[6.zip][01_05_2005.exe]
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\User\My Documents\Downloads\ComboFix.exe[nircmd.exe]
Potentially unwanted tool:Application/Processor Not disinfected C:\Downloads\Nailfix.zip[Nailfix/Process.exe]
Potentially unwanted tool:Application/Processor Not disinfected C:\Downloads\New Folder\Nailfix\Process.exe
Adware:Adware/Yazzle Not disinfected C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1162OinUninstaller.exe.vir
Spyware:Spyware/Virtumonde Not disinfected C:\QooBox\Quarantine\C\WINDOWS\system32\gxiiquae.dll.vir
Spyware:Spyware/Virtumonde Not disinfected C:\RECYCLER\NPROTECT\00123936.dll
Virus:Trj/Clicker.ACO Disinfected C:\RECYCLER\S-1-5-21-782189750-2106517767-3757435101-500\Dc4.exe
Spyware:Spyware/Virtumonde Not disinfected C:\VundoFix Backups\cdhinqvd.dll.bad
Spyware:Spyware/Virtumonde Not disinfected C:\VundoFix Backups\dxiniiui.dll.bad
Spyware:Spyware/Virtumonde Not disinfected C:\VundoFix Backups\jkklj.dll.bad
Spyware:Spyware/Virtumonde Not disinfected C:\VundoFix Backups\mljhihf.dll.bad
Spyware:Spyware/Vundo Not disinfected C:\VundoFix Backups\oxrtmxhf.dll.bad
Spyware:Spyware/Vundo Not disinfected C:\VundoFix Backups\qwqqhavo.dll.bad
Spyware:Spyware/Virtumonde Not disinfected C:\VundoFix Backups\vtsqo.dll.bad
Spyware:Spyware/Virtumonde Not disinfected C:\VundoFix Backups\vtstu.dll.bad
Spyware:Spyware/Vundo Not disinfected C:\VundoFix Backups\yfplehbt.dll.bad
Virus:Trj/Keyhost.A Disinfected C:\WINDOWS\inf\host.inf
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\nircmd.exe
Logfile of HijackThis v1.99.1
Scan saved at 7:39:39 PM, on 06/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Mouse\Amoumain.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\system32\carpserv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Cacheman\Cacheman.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\mozilla.org\Mozilla\mozilla.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Downloads\New Folder\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1B041C3A-2697-47D1-A0A5-2DDFEBCC96B6} - C:\WINDOWS\system32\vtstu.dll (file missing)
O2 - BHO: (no name) - {47057EFC-2DD2-475A-A41B-BF74B05A5319} - C:\WINDOWS\system32\jkklj.dll (file missing)
O2 - BHO: (no name) - {B2DEC5DB-BB0B-44DA-9961-B8C0600761C8} - C:\WINDOWS\system32\vtsqo.dll (file missing)
O2 - BHO: (no name) - {F5E924A5-3D05-4652-BB2F-EF3478A393F6} - C:\WINDOWS\system32\ssttr.dll (file missing)
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [JeticoPFStartup] "C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe"
O4 - HKCU\..\Run: [Cacheman] C:\PROGRA~1\Cacheman\Cacheman.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://acs.pandasoftware.com/activescan ... asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FC56EDF3-E542-4036-9160-0511D7211541}: NameServer = 64.59.168.13,64.59.168.15
O18 - Protocol: cw - {774E529C-2458-48A2-8F57-3ED3105D8612} - c:\program files\caseware2005\cwproto.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe