I have tried everything. Vundo Fix, ComboFix, Panda's PQRemove., AVG. I've run these in Safe Mode and regular boot up mode.
The latest attempt at Combofix seemed to cut down on the pop ups but I still get an advertisement pop up that says "Advertisement- Microsoft INternet Explorer" at the top of the window. Even if I have not opened the internet explorer program. I am guessing that internet explorer is not acutally opened but the malware is trying to get me to open it. Anyway I've attached the Combofix log and the Hijack this log below. Please help me remove this software. THanks.
Hijack this log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:24:29 PM, on 4/17/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\pavsrv51.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\AVENGINE.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\PANICW~1\POP-UP~3\PSFree.exe
C:\Program Files\Twain\Twain.exe
C:\Documents and Settings\Administrator\Application Data\SpeedRunner\SpeedRunner.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\lugudb.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsCtrls.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\psimsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\ApvxdWin.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\WebProxy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\psimreal.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {584C5668-9E23-4BC2-989D-2FCA1A07B3E3} - C:\WINDOWS\System32\vtutu.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: BndBlock5 BHO Class - {82EA1A55-9CBC-404b-9D0C-E8BFB7EAAE9B} - C:\Program Files\QdrDrive\QdrDrive10.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O2 - BHO: (no name) - {E0E765A4-74A2-45BD-B1AF-AE07F2A174E7} - C:\WINDOWS\System32\vturr.dll (file missing)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {EF7D8850-CA99-405C-987C-3380ADE566A7} - C:\WINDOWS\System32\awvtr.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84"
O4 - HKLM\..\Run: [EPSON Stylus C84 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P32 "EPSON Stylus C84 Series (Copy 1)" /O6 "USB001" /M "Stylus C84"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~3\PSFree.exe"
O4 - HKCU\..\Run: [QdrModule10] "C:\Program Files\QdrModule\QdrModule10.exe"
O4 - HKCU\..\Run: [AdwareProMFC] C:\Program Files\Ad-Ware Pro\Ad-Ware Pro.exe
O4 - HKCU\..\Run: [Rndo] "C:\DOCUME~1\ADMINI~1\APPLIC~1\RACLE~1\javaw.exe" -vt yazb
O4 - HKCU\..\Run: [QdrModule15] "C:\Program Files\QdrModule\QdrModule15.exe"
O4 - HKCU\..\Run: [QdrPack15] "C:\Program Files\QdrPack\QdrPack15.exe"
O4 - HKCU\..\Run: [Smcse] C:\WINDOWS\?racle\u?erinit.exe
O4 - HKCU\..\Run: [Twain] C:\Program Files\Twain\Twain.exe
O4 - HKCU\..\Run: [SpeedRunner] C:\Documents and Settings\Administrator\Application Data\SpeedRunner\SpeedRunner.exe
O4 - HKCU\..\Run: [SfKg6wIP] C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\lugudb.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
O14 - IERESET.INF: START_PAGE_URL=http://www.pcxplode.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - https://modsecgat.dimeshare.com/mod/cds ... ica32t.exe
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/qtinstall.info. ... taller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 5874778312
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 2429600125
O16 - DPF: {A609CB6E-FEB5-47C3-966C-1B916842BD01} (Nlopflash Class) - http://poker.nlop.com/poker/PokerCreations.cab
O20 - Winlogon Notify: efcayyy - efcayyy.dll (file missing)
O20 - Winlogon Notify: ohjqxnbv - ohjqxnbv.dll (file missing)
O21 - SSODL: Cmpaplib - {CF7DC1AC-4560-46DC-A054-17CDF20F3692} - C:\WINDOWS\System32\bitamdel.dll
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\pavsrv51.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\psimsvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\TPSrv.exe
--
End of file - 9481 bytes
ComboFix Log:
ComboFix 08-04-13.1 - Administrator 2008-04-17 20:04:50.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.608 [GMT -4:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Administrator\Application Data\RACLE~1
C:\Documents and Settings\Administrator\Application Data\RACLE~1\?racle\
C:\Documents and Settings\Administrator\Application Data\RACLE~1\javaw.exe
C:\Documents and Settings\Administrator\Application Data\WinTouch
C:\Documents and Settings\Administrator\Application Data\WinTouch\wintouch.cfg
C:\Documents and Settings\Administrator\Application Data\WinTouch\WinTouch.exe
C:\Documents and Settings\Administrator\Application Data\WinTouch\WTUninstaller.exe
C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Speed Monitor
C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk
C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk
C:\Documents and Settings\Administrator\Start Menu\Programs\Outerinfo
C:\Documents and Settings\Administrator\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\Administrator\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\Program Files\CPV
C:\Program Files\CPV\CPV8.dll
C:\Program Files\CPV\CPV8.dll.lzma
C:\Program Files\inetget2
C:\Program Files\inetget2\SRInstaller.exe
C:\Program Files\ISM
C:\Program Files\ISM\ism.exe
C:\Program Files\ISM\Uninstall.exe
C:\Program Files\outerinfo
C:\Program Files\outerinfo\FF\chrome.manifest
C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt
C:\Program Files\outerinfo\FF\install.rdf
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\QdrDrive
C:\Program Files\QdrDrive\QdrDrive15.dll
C:\Program Files\QdrDrive\qdrloader.exe
C:\Program Files\QdrModule
C:\Program Files\QdrModule\dic.gz
C:\Program Files\QdrModule\dicy.gz
C:\Program Files\QdrModule\kwd.gz
C:\Program Files\QdrModule\kwdy.gz
C:\Program Files\QdrModule\QdrModule15.exe
C:\Program Files\QdrPack
C:\Program Files\QdrPack\dicts.gz
C:\Program Files\QdrPack\QdrPack15.exe
C:\Program Files\QdrPack\trgts.gz
C:\Program Files\Temporary
C:\Program Files\Temporary\InsiDERInst.exe
C:\WINDOWS\pskt.ini
C:\WINDOWS\racle~1
C:\WINDOWS\racle~1\u?erinit.exe
C:\WINDOWS\system32\000070.exe
C:\WINDOWS\system32\000080.exe
C:\WINDOWS\system32\000090.exe
C:\WINDOWS\system32\eajeftfp.ini
C:\WINDOWS\system32\fncmapyo.ini
C:\WINDOWS\system32\fuomqsmg.dll
C:\WINDOWS\system32\jbwrbogw.dll
C:\WINDOWS\system32\kjukkdej.dll
C:\WINDOWS\system32\nnnnNDtS.dll
C:\WINDOWS\system32\omscsntm.dll
C:\WINDOWS\system32\pmnmkHaW.dll
C:\WINDOWS\system32\pngemrja.dll
C:\WINDOWS\system32\StDNnnnn.ini
C:\WINDOWS\system32\StDNnnnn.ini2
C:\WINDOWS\system32\stqvlpqe.dll
C:\WINDOWS\system32\tnntmmrh.ini
C:\WINDOWS\system32\wgobrwbj.ini
C:\WINDOWS\system32\xpcqljri.dll
C:\WINDOWS\system32\xpghck.dll
C:\WINDOWS\system32\ymsmtuhb.dll
C:\WINDOWS\system32\ypbwdnvm.dll
.
((((((((((((((((((((((((( Files Created from 2008-03-18 to 2008-04-18 )))))))))))))))))))))))))))))))
.
2008-04-17 07:05 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-04-17 07:05 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-04-17 07:05 . 2008-04-14 19:28 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-04-17 07:05 . 2008-04-12 13:49 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-04-17 07:05 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-04-17 07:05 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-04-17 07:05 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-04-16 18:17 . 2008-04-16 18:25 3,660 --a------ C:\WINDOWS\system32\tmp.reg
2008-04-16 16:28 . 2008-04-16 16:28 38,400 -ra------ C:\WINDOWS\mrofinu72.exe
2008-04-16 07:27 . 2008-04-16 07:33 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-15 20:40 . 2008-04-15 20:40 22 --a------ C:\WINDOWS\b104.exe.bin
2008-04-15 19:25 . 2008-04-15 19:25 <DIR> d-------- C:\Program Files\Inet_Get_2
2008-04-15 19:20 . 2008-04-15 20:45 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SpeedRunner
2008-04-15 19:15 . 2008-04-17 06:44 <DIR> d-------- C:\Program Files\Twain
2008-04-15 19:15 . 2008-04-15 19:15 9,216 --a------ C:\WINDOWS\system32\~.exe
2008-04-14 20:43 . 2008-04-14 17:43 74,240 --a------ C:\WINDOWS\b156.exe
2008-04-14 14:08 . 2008-04-14 11:08 46,592 --a------ C:\WINDOWS\b157.exe
2008-04-13 16:22 . 2008-04-13 16:22 281 --a------ C:\WINDOWS\system32\PavCPL.dat
2008-04-13 16:21 . 2007-07-12 08:42 292,144 --a------ C:\WINDOWS\system32\PavSHook.dll
2008-04-13 16:21 . 2007-03-13 18:01 161,328 --a------ C:\WINDOWS\system32\TpUtil.dll
2008-04-13 16:21 . 2006-06-27 19:36 101,888 --a------ C:\WINDOWS\system32\SYSTOOLS.DLL
2008-04-13 16:21 . 2007-02-28 18:04 63,024 --a------ C:\WINDOWS\system32\pavipc.dll
2008-04-13 16:21 . 2007-02-15 20:02 50,736 --a------ C:\WINDOWS\system32\avldr.dll
2008-04-13 15:45 . 2008-04-13 15:45 3,648 --a------ C:\WINDOWS\system32\osairpsf.dll
2008-04-13 15:00 . 2008-04-13 15:00 3,648 --a------ C:\WINDOWS\system32\mehaabct.dll
2008-04-13 14:59 . 2008-04-13 20:33 <DIR> d-------- C:\Program Files\RcvSystem
2008-04-13 14:55 . 2008-04-13 16:30 <DIR> d-------- C:\WINDOWS\system32\PAV
2008-04-13 14:53 . 2008-04-13 14:55 <DIR> d-------- C:\Program Files\Mozilla Firefox(2)
2008-04-13 14:53 . 2008-04-13 14:53 0 --a------ C:\WINDOWS\nsreg.dat
2008-04-11 10:48 . 2008-04-11 07:48 11,264 --a------ C:\WINDOWS\b138.exe
2008-04-08 19:33 . 2008-04-08 16:33 68,096 --a------ C:\WINDOWS\b155.exe
2008-04-07 05:44 . 2008-04-07 05:44 396 --a------ C:\WINDOWS\system32\L5807.tmp
2008-04-07 05:44 . 2008-04-07 05:44 396 --a------ C:\WINDOWS\system32\L53A2.tmp
2008-04-07 05:44 . 2008-04-07 05:44 396 --a------ C:\WINDOWS\system32\L4D97.tmp
2008-04-07 05:44 . 2008-04-07 05:44 396 --a------ C:\WINDOWS\system32\L4588.tmp
2008-04-04 13:25 . 2008-04-04 13:25 187,904 ---hs---- C:\Program Files\Common Files\Yazzle1552OinAdmin.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-18 00:01 13,880 ----a-w C:\WINDOWS\system32\drivers\COMFiltr.sys
2008-04-16 01:21 --------- d-----w C:\Program Files\TrojanHunter 4.6
2008-04-16 01:21 --------- d-----w C:\Program Files\ewido anti-malware
2008-03-30 22:19 --------- d-----w C:\Documents and Settings\Administrator\Application Data\AdobeUM
2008-03-02 14:26 73,728 ----a-w C:\WINDOWS\b153.exe
2008-02-29 11:28 --------- d-----w C:\Program Files\Google
2008-02-29 11:14 --------- d-----w C:\Program Files\Rhapsody
2008-02-29 11:12 --------- d-----w C:\Program Files\PartyGaming
2008-02-27 13:15 --------- d-----w C:\Program Files\Common Files\Panda Software
2008-02-27 12:00 --------- d-----w C:\Program Files\Panda Security
2008-02-20 13:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\sentinel
2008-02-20 12:44 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-30 13:25 60,968 ----a-w C:\Documents and Settings\Administrator\GoToAssistDownloadHelper.exe
2006-07-04 12:51 825,632 ----a-w C:\Documents and Settings\All Users\english.dat
2006-07-04 12:51 790,928 ----a-w C:\Documents and Settings\All Users\chinese.dat
2006-07-04 12:51 63,120 ----a-w C:\Documents and Settings\All Users\embeddedurls_new.dat
2006-07-04 12:51 596,608 ----a-w C:\Documents and Settings\All Users\spanish.dat
2006-07-04 12:51 54,416 ----a-w C:\Documents and Settings\All Users\extratings_insert.dat
2006-07-04 12:51 444,272 ----a-w C:\Documents and Settings\All Users\precaturls_new.dat
2006-07-04 12:51 258,048 ----a-w C:\Documents and Settings\All Users\UpdaterScript.exe
2006-05-30 01:02 24,192 ----a-w C:\Documents and Settings\Administrator\usbsermptxp.sys
2006-05-30 01:02 22,768 ----a-w C:\Documents and Settings\Administrator\usbsermpt.sys
2005-05-24 21:41 63,264 -c--a-w C:\Documents and Settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT
2006-03-19 17:03 10,022 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((( snapshot@2008-01-04_20.28.08.35 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-12-28 03:28:19 2,560 ----a-w C:\WINDOWS\_MSRSTRT.EXE
+ 2008-04-18 00:10:09 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2006-07-11 13:41:36 345,656 ----a-w C:\WINDOWS\Downloaded Program Files\ewidoOnlineScan.dll
+ 2005-10-21 00:02:28 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
- 2000-08-31 13:00:00 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2005-10-21 00:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2000-08-31 12:00:00 73,728 ----a-w C:\WINDOWS\fdsv.exe
+ 2006-02-16 12:59:06 2,302 ----a-w C:\WINDOWS\fzko\fzko.dat
+ 2000-08-31 12:00:00 80,412 ----a-w C:\WINDOWS\grep.exe
+ 2008-02-20 12:32:04 65,536 ----a-r C:\WINDOWS\Installer\{685A56F8-75B6-44AD-B3DA-FB0A3266B47C}\ARPPRODUCTICON.exe
+ 2004-12-27 20:27:11 2,560 -c--a-r C:\WINDOWS\Installer\{90190409-6000-11D3-8CFE-0050048383C9}\cagicon.exe
+ 2004-12-27 20:07:58 2,560 -c--a-r C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\cagicon.exe
+ 2004-12-25 01:24:51 2,678 -c--a-w C:\WINDOWS\java\Packages\Data\07DVPZJ3.DAT
+ 2004-12-25 01:24:50 2,678 -c--a-w C:\WINDOWS\java\Packages\Data\9RLBF53D.DAT
+ 2004-12-25 01:24:51 2,678 -c--a-w C:\WINDOWS\java\Packages\Data\DZ1BR3Z1.DAT
+ 2004-12-25 01:24:51 2,678 -c--a-w C:\WINDOWS\java\Packages\Data\VNB7Z3P7.DAT
+ 2004-12-25 01:24:53 2,678 -c--a-w C:\WINDOWS\java\Packages\Data\XZB71BTN.DAT
- 2000-08-31 13:00:00 51,200 ----a-w C:\WINDOWS\NirCmd.exe
+ 2000-08-31 12:00:00 28,160 ----a-w C:\WINDOWS\Nircmd.exe
+ 2004-12-27 20:53:04 2,706 ----a-w C:\WINDOWS\PCHealth\HelpCtr\PackageStore\SkuStore.bin
+ 2000-08-31 12:00:00 98,816 ----a-w C:\WINDOWS\sed.exe
+ 2000-08-31 12:00:00 161,792 ----a-w C:\WINDOWS\swreg.exe
+ 2000-08-31 12:00:00 136,704 ----a-w C:\WINDOWS\swsc.exe
+ 2000-08-31 12:00:00 212,480 ----a-w C:\WINDOWS\swxcacls.exe
+ 2001-09-26 00:01:00 2,000 -c--a-w C:\WINDOWS\system\KEYBOARD.DRV
+ 2001-09-26 00:01:20 73,376 -c--a-w C:\WINDOWS\system\MCIAVI.DRV
+ 2001-09-26 00:01:20 25,264 -c--a-w C:\WINDOWS\system\MCISEQ.DRV
+ 2001-09-26 00:01:20 28,160 ----a-w C:\WINDOWS\system\MCIWAVE.DRV
+ 2001-09-26 00:01:30 2,032 -c--a-w C:\WINDOWS\system\MOUSE.DRV
+ 2001-09-26 00:02:28 1,744 -c--a-w C:\WINDOWS\system\SOUND.DRV
+ 2001-09-26 00:02:36 3,360 -c--a-w C:\WINDOWS\system\SYSTEM.DRV
+ 2001-09-26 00:02:38 4,048 -c--a-w C:\WINDOWS\system\TIMER.DRV
+ 2001-09-26 00:02:48 2,176 ----a-w C:\WINDOWS\system\VGA.DRV
+ 2001-09-26 00:02:54 13,600 -c--a-w C:\WINDOWS\system\WFWNET.DRV
+ 2002-08-29 14:41:32 132,096 ----a-w C:\WINDOWS\system\WINSPOOL.DRV
+ 2008-04-15 23:15:55 9,216 ----a-w C:\WINDOWS\system32\~.exe
- 2007-11-24 23:50:10 15,782 ----a-w C:\WINDOWS\system32\cmpusfav.dll
+ 2008-02-20 13:57:52 15,829 ----a-w C:\WINDOWS\system32\cmpusfav.dll
+ 2001-09-26 00:00:18 10,544 ----a-w C:\WINDOWS\system32\comm.drv
- 2008-01-05 01:24:45 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-04-18 00:10:16 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2007-11-14 21:39:58 2,173 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_10.dat
+ 2007-11-14 21:42:12 2,339 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_112.dat
+ 2007-11-14 21:42:37 2,277 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_134.dat
+ 2007-11-14 21:42:42 2,677 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_148.dat
+ 2007-11-14 21:42:43 1,505 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_153.dat
+ 2007-11-14 21:42:44 2,274 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_154.dat
+ 2007-11-14 21:42:46 1,638 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_163.dat
+ 2007-11-14 21:42:47 1,532 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_166.dat
+ 2007-11-14 21:42:50 2,834 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_176.dat
+ 2007-11-22 13:45:11 3,068 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_187.dat
+ 2007-11-22 13:45:14 1,884 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_195.dat
+ 2007-11-14 21:41:22 2,869 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_21.dat
+ 2007-11-14 21:41:23 2,104 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_22.dat
+ 2007-11-14 21:41:43 3,000 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_25.dat
+ 2007-11-14 21:41:48 1,621 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_40.dat
+ 2007-11-14 21:41:49 2,523 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_43.dat
+ 2007-11-14 21:39:55 1,666 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_5.dat
+ 2007-11-14 21:41:53 2,335 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_57.dat
+ 2007-11-14 21:41:58 1,819 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_75.dat
+ 2007-11-14 21:42:00 2,314 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_79.dat
+ 2007-11-14 21:39:58 2,761 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Panda Software\AntiSpam\pav_9.dat
- 2008-01-05 01:24:45 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-04-18 00:10:16 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-01-05 01:24:45 49,152 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-04-18 00:10:16 49,152 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2002-08-29 14:57:58 1,740 -c--a-w C:\WINDOWS\system32\Dcache.bin
+ 2002-08-29 06:32:34 2,816 -c--a-w C:\WINDOWS\system32\dllcache\drmkaud.sys
+ 2001-09-26 00:01:00 2,000 -c--a-w C:\WINDOWS\system32\dllcache\keyboard.drv
+ 2001-09-26 00:01:20 2,560 -c--a-w C:\WINDOWS\system32\dllcache\lz32.dll
+ 2001-09-26 00:01:20 73,376 -c--a-w C:\WINDOWS\system32\dllcache\mciavi.drv
+ 2001-09-26 00:01:20 25,264 -c--a-w C:\WINDOWS\system32\dllcache\mciseq.drv
+ 2001-09-26 00:01:20 28,160 -c--a-w C:\WINDOWS\system32\dllcache\mciwave.drv
+ 2001-09-26 00:01:30 2,032 -c--a-w C:\WINDOWS\system32\dllcache\mouse.drv
+ 2001-09-26 00:01:56 2,944 -c--a-w C:\WINDOWS\system32\dllcache\null.sys
+ 2001-09-26 00:02:28 1,744 -c--a-w C:\WINDOWS\system32\dllcache\sound.drv
+ 2001-09-26 00:02:36 3,360 -c--a-w C:\WINDOWS\system32\dllcache\system.drv
+ 2001-09-26 00:02:38 4,048 -c--a-w C:\WINDOWS\system32\dllcache\timer.drv
+ 2001-09-26 00:02:48 2,176 -c--a-w C:\WINDOWS\system32\dllcache\vga.drv
+ 2001-09-26 00:02:54 13,600 -c--a-w C:\WINDOWS\system32\dllcache\wfwnet.drv
+ 2001-09-26 00:03:10 2,864 -c--a-w C:\WINDOWS\system32\dllcache\winsock.dll
+ 2002-08-29 14:41:32 132,096 -c--a-w C:\WINDOWS\system32\dllcache\winspool.drv
+ 2001-09-26 00:03:10 2,112 -c--a-w C:\WINDOWS\system32\dllcache\winspool.exe
+ 2001-09-26 00:03:16 2,736 -c--a-w C:\WINDOWS\system32\dllcache\wowdeb.exe
- 2005-08-12 19:36:56 16,640 ----a-w C:\WINDOWS\system32\drivers\cpoint.sys
+ 2007-06-08 12:44:06 24,760 ----a-w C:\WINDOWS\system32\drivers\cpoint.sys
+ 2002-08-29 06:32:34 2,816 ----a-w C:\WINDOWS\system32\drivers\drmkaud.sys
+ 2001-09-26 00:01:56 2,944 ----a-w C:\WINDOWS\system32\drivers\null.sys
- 2006-02-22 08:43:34 71,552 ----a-r C:\WINDOWS\system32\drivers\pavdrv51.sys
+ 2007-06-06 14:43:32 83,640 ----a-w C:\WINDOWS\system32\drivers\pavdrv51.sys
- 2006-04-25 15:02:48 165,120 ----a-r C:\WINDOWS\system32\drivers\PavProc.sys
+ 2007-07-12 18:49:38 178,872 ----a-w C:\WINDOWS\system32\drivers\PavProc.sys
+ 2007-05-23 20:40:30 38,968 ----a-w C:\WINDOWS\system32\drivers\ShlDrv51.sys
+ 2001-09-26 00:01:00 2,000 -c--a-w C:\WINDOWS\system32\keyboard.drv
+ 2001-09-26 00:01:18 221,600 -c--a-w C:\WINDOWS\system32\lanman.drv
- 2006-11-22 17:37:20 143,360 ----a-w C:\WINDOWS\system32\libexpat.dll
+ 2008-03-15 01:37:59 151,552 ----a-w C:\WINDOWS\system32\libexpat.dll
+ 2001-09-26 00:01:20 2,560 ----a-w C:\WINDOWS\system32\lz32.dll
+ 2006-11-09 19:46:28 190,072 ----a-w C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe
+ 2001-09-26 00:01:20 73,376 -c--a-w C:\WINDOWS\system32\mciavi.drv
+ 2001-09-26 00:01:20 25,264 -c--a-w C:\WINDOWS\system32\mciseq.drv
+ 2001-09-26 00:01:20 28,160 ----a-w C:\WINDOWS\system32\mciwave.drv
+ 2001-09-26 00:01:30 2,032 -c--a-w C:\WINDOWS\system32\mouse.drv
+ 2001-09-26 00:01:34 20,480 ----a-w C:\WINDOWS\system32\msacm32.drv
+ 2002-08-29 14:41:32 184,320 ----a-w C:\WINDOWS\system32\msh261.drv
+ 2002-08-29 14:50:10 286,720 ----a-w C:\WINDOWS\system32\msh263.drv
- 2004-02-25 16:05:28 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
+ 2006-02-03 16:00:00 348,160 ----a-w C:\WINDOWS\system32\MSVCR71.DLL
+ 2001-09-26 00:01:50 2,656 -c--a-w C:\WINDOWS\system32\netware.drv
- 2007-12-11 01:38:47 52,996 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-04-13 20:30:16 52,996 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-12-11 01:38:47 380,966 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-04-13 20:30:16 380,966 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-10-17 07:33:10 2,048,000 ----a-w C:\WINDOWS\system32\python25.dll
- 2007-12-09 22:12:38 48,480 ----a-w C:\WINDOWS\system32\Restore\rstrlog.dat
+ 2008-04-13 18:56:02 449,512 ----a-w C:\WINDOWS\system32\Restore\rstrlog.dat
+ 2001-09-26 00:02:28 1,744 -c--a-w C:\WINDOWS\system32\sound.drv
+ 2003-12-23 18:49:58 2,348 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\E_A4X2D1.DAT
+ 2006-04-03 09:00:00 2,981 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FAIFBIA.DAT
+ 2003-12-23 18:49:58 2,348 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\epsonstylus_c845b4d\E_A4X2D1.DAT
+ 2006-04-03 09:00:00 2,981 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\epsonstylus_cx60008c3e\E_FAIFBIA.DAT
+ 2001-09-26 00:02:36 3,360 -c--a-w C:\WINDOWS\system32\system.drv
+ 2001-09-26 00:02:38 4,048 -c--a-w C:\WINDOWS\system32\timer.drv
- 2006-07-05 10:46:36 205,696 ----a-w C:\WINDOWS\system32\vbamac32.dll
+ 2006-07-05 10:46:36 177,218 ----a-w C:\WINDOWS\system32\vbamac32.dll
+ 2001-09-26 00:02:48 2,176 -c--a-w C:\WINDOWS\system32\vga.drv
+ 2001-08-18 03:37:04 22,016 ----a-w C:\WINDOWS\system32\wdmaud.drv
+ 2001-09-26 00:02:54 13,600 -c--a-w C:\WINDOWS\system32\wfwnet.drv
+ 2001-09-26 00:03:10 2,864 ----a-w C:\WINDOWS\system32\winsock.dll
+ 2002-08-29 14:41:32 132,096 ----a-w C:\WINDOWS\system32\winspool.drv
+ 2001-09-26 00:03:10 2,112 ----a-w C:\WINDOWS\system32\winspool.exe
+ 2001-09-26 00:03:16 2,736 ----a-w C:\WINDOWS\system32\wowdeb.exe
- 2006-11-22 17:41:14 282,112 ----a-w C:\WINDOWS\system32\wxIE.dll
+ 2008-03-15 01:37:59 300,816 ----a-w C:\WINDOWS\system32\wxIE.dll
+ 2000-08-31 12:00:00 49,152 ----a-w C:\WINDOWS\VFind.exe
+ 2006-12-02 03:56:00 96,256 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
+ 2006-12-02 03:54:32 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-02 03:54:34 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-02 03:54:32 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2006-12-02 05:25:52 1,101,824 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2006-12-02 05:25:56 1,093,120 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-02 05:25:58 69,632 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-02 05:26:00 57,856 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-02 05:08:00 40,960 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-02 05:08:00 45,056 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-02 05:08:00 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-02 05:08:00 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-02 05:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-02 05:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-02 05:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-02 05:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-02 05:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-02 05:46:44 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
+ 2000-08-31 12:00:00 68,096 ----a-w C:\WINDOWS\zip.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{584C5668-9E23-4BC2-989D-2FCA1A07B3E3}]
C:\WINDOWS\System32\vtutu.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{82EA1A55-9CBC-404b-9D0C-E8BFB7EAAE9B}]
C:\Program Files\QdrDrive\QdrDrive10.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E0E765A4-74A2-45BD-B1AF-AE07F2A174E7}]
C:\WINDOWS\System32\vturr.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EF7D8850-CA99-405C-987C-3380ADE566A7}]
C:\WINDOWS\System32\awvtr.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2002-08-29 10:41 13312]
"PopUpStopperFreeEdition"="C:\PROGRA~1\PANICW~1\POP-UP~3\PSFree.exe" [2003-04-29 11:40 524288]
"QdrModule10"="C:\Program Files\QdrModule\QdrModule10.exe" [ ]
"AdwareProMFC"="C:\Program Files\Ad-Ware Pro\Ad-Ware Pro.exe" [ ]
"Rndo"="C:\DOCUME~1\ADMINI~1\APPLIC~1\RACLE~1\javaw.exe" [ ]
"QdrModule15"="C:\Program Files\QdrModule\QdrModule15.exe" [ ]
"QdrPack15"="C:\Program Files\QdrPack\QdrPack15.exe" [ ]
"Smcse"="C:\WINDOWS\?racle\u?erinit.exe" [ ]
"Twain"="C:\Program Files\Twain\Twain.exe" [2008-04-15 19:15 57344]
"SpeedRunner"="C:\Documents and Settings\Administrator\Application Data\SpeedRunner\SpeedRunner.exe" [2008-04-15 19:20 181248]
"SfKg6wIP"="C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\lugudb.exe" [2008-04-15 19:20 35328]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2004-02-10 12:55 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2004-02-10 12:51 118784]
"Tweak UI"="TWEAKUI.CPL" [2000-06-18 15:03 106544 C:\WINDOWS\system32\TWEAKUI.CPL]
"EPSON Stylus C84 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.exe" [2003-05-27 04:00 99840]
"EPSON Stylus C84 Series (Copy 1)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.exe" [2003-05-27 04:00 99840]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2003-12-01 12:38 892928]
"Logitech Utility"="Logi_MwX.Exe" [2003-11-07 05:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41 282624]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51 257088]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [2006-11-09 16:07 49263]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-02-25 14:41:01 169472]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"Cmpaplib"= {CF7DC1AC-4560-46DC-A054-17CDF20F3692} - C:\WINDOWS\System32\bitamdel.dll [2006-07-05 06:46 843776]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
avldr.dll 2007-02-15 20:02 50736 C:\WINDOWS\system32\avldr.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcayyy]
efcayyy.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ohjqxnbv]
ohjqxnbv.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^xhxp.exe]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\xhxp.exe
backup=C:\WINDOWS\pss\xhxp.exeCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2002-08-29 10:41 13312 C:\WINDOWS\System32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-06-01 16:51 257088 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-04-27 09:41 282624 C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winsync]
C:\WINDOWS\System32\wiwyar.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
R1 ewido security suite driver;ewido security suite driver;C:\Program Files\ewido anti-malware\guard.sys [2005-12-30 07:12]
R1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\System32\Drivers\ShlDrv51.sys [2007-05-23 16:40]
R2 PavProc;Panda Process Protection Driver;C:\WINDOWS\System32\DRIVERS\PavProc.sys [2007-07-12 14:49]
R3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\System32\DRIVERS\COMFiltr.sys [2008-04-17 20:12]
S3 PavSRK.sys;PavSRK.sys;C:\WINDOWS\System32\PavSRK.sys []
S3 PavTPK.sys;PavTPK.sys;C:\WINDOWS\System32\PavTPK.sys []
S3 Wdm1;USB Bridge Cable Driver;C:\WINDOWS\System32\Drivers\usbbc.sys [2001-01-07 21:53]
*Newly Created Service* - COMFILTR
.
Contents of the 'Scheduled Tasks' folder
"2008-03-06 03:23:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-17 20:11:10
Windows 5.1.2600 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\System32\bitamdel.dll
-> C:\WINDOWS\System32\camohaut.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PAVSRV51.EXE
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\AVENGINE.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsCtrlS.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\PavPrSrv.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsImSvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\APVXDWIN.EXE
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\WEBPROXY.EXE
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-04-17 20:15:38 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-18 00:15:21
ComboFix2.txt 2008-01-05 01:28:56
Pre-Run: 19,702,435,840 bytes free
Post-Run: 20,227,022,848 bytes free
