Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.959.398 [GMT -4:00]
Running from: c:\documents and settings\Owner.BSC\My Documents\Downloads\ComboFix.exe
AV: AVG Anti-Virus *On-access scanning disabled* (Updated)
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\Owner.BSC\LOCALS~1\Temp\tmp2.tmp
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\aguremot.ini
c:\windows\system32\apibujoh.ini
c:\windows\system32\arulasad.ini
c:\windows\system32\asirebiv.ini
c:\windows\system32\awazokaw.ini
c:\windows\system32\Cache
c:\windows\system32\cbcvcuqf.ini
c:\windows\system32\devopaha.dll
c:\windows\system32\dugigidu.dll
c:\windows\system32\duvotihe.dll
c:\windows\system32\ebagufez.ini
c:\windows\system32\elavoyur.ini
c:\windows\system32\elilovoh.ini
c:\windows\system32\enivopaz.ini
c:\windows\system32\enujumub.ini
c:\windows\system32\ezudotib.ini
c:\windows\system32\ganotida.dll
c:\windows\system32\gidogudi.dll
c:\windows\system32\hakodoso.dll
c:\windows\system32\higudivo.dll.tmp
c:\windows\system32\idugodig.ini
c:\windows\system32\ifuvenej.ini
c:\windows\system32\igiwubef.ini
c:\windows\system32\ikigawer.ini
c:\windows\system32\ilavoneg.ini
c:\windows\system32\inazikun.ini
c:\windows\system32\iqqukwek.ini
c:\windows\system32\isogefel.ini
c:\windows\system32\itoyafob.ini
c:\windows\system32\iyibihap.ini
c:\windows\system32\iyopojen.ini
c:\windows\system32\izepojak.ini
c:\windows\system32\jepazeje.dll.tmp
c:\windows\system32\kelinepe.dll.tmp
c:\windows\system32\muhatohu.dll
c:\windows\system32\newuwiyo.dll
c:\windows\system32\ogaremuh.ini
c:\windows\system32\ogikujid.ini
c:\windows\system32\ogolapaf.ini
c:\windows\system32\okagadeh.ini
c:\windows\system32\omunodup.ini
c:\windows\system32\opkpeoxs.ini
c:\windows\system32\ososajev.ini
c:\windows\system32\ovenubih.ini
c:\windows\system32\ovomodiv.ini
c:\windows\system32\owajafay.ini
c:\windows\system32\povisema.dll.tmp
c:\windows\system32\pudonumo.dll
c:\windows\system32\puswrdoj.ini
c:\windows\system32\ruyovale.dll
c:\windows\system32\semijuwi.dll
c:\windows\system32\ubakiwod.ini
c:\windows\system32\ubwylpva.ini
c:\windows\system32\udawekag.ini
c:\windows\system32\ufifakov.ini
c:\windows\system32\ugujubet.ini
c:\windows\system32\umajejij.ini
c:\windows\system32\uremehew.ini
c:\windows\system32\utasuset.ini
c:\windows\system32\vFgPYJjl.ini
c:\windows\system32\vFgPYJjl.ini2
c:\windows\system32\vixfvelr.ini
c:\windows\system32\wavemile.dll
c:\windows\system32\wisegava.dll.tmp
c:\windows\system32\yopopanu.dll
c:\windows\system32\yuhoraki.dll
c:\windows\system32\zasezara.dll
c:\windows\system32\zulalahu.dll.tmp
c:\windows\wiaservv.log
D:\Autorun.inf
----- BITS: Possible infected sites -----
hxxp://82.98.235.205
hxxp://77.74.48.105
.
((((((((((((((((((((((((( Files Created from 2009-03-02 to 2009-04-02 )))))))))))))))))))))))))))))))
.
2009-04-01 23:42 . 2009-04-01 23:42 2,713 ---hs---- c:\windows\system32\doyifari.dll
2009-03-31 10:20 . 2009-03-31 10:20 <DIR> d-------- C:\TIBCOProjects
2009-03-26 12:18 . 2009-03-26 12:18 <DIR> d-------- c:\program files\Viewpoint
2009-03-26 12:18 . 2009-03-26 12:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\Viewpoint
2009-03-26 12:17 . 2009-03-26 12:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\AOL OCP
2009-03-26 12:17 . 2009-03-28 18:18 999 --ah----- C:\IPH.PH
2009-03-25 19:35 . 2009-03-25 19:35 <DIR> d-------- c:\documents and settings\Owner.BSC\Application Data\TVU networks
2009-03-19 21:07 . 2009-03-19 21:07 <DIR> d-------- c:\documents and settings\All Users\Application Data\TVU Networks
2009-03-14 12:51 . 2007-03-28 09:16 344,064 --a------ c:\windows\system32\lxddcoin.dll
2009-03-14 12:51 . 2006-05-17 22:47 40,960 --a------ c:\windows\system32\lxddvs.dll
2009-03-14 12:50 . 2007-01-09 12:13 692,224 --a------ c:\windows\system32\lxdddrs.dll
2009-03-14 12:50 . 2006-10-06 13:08 69,632 --a------ c:\windows\system32\lxddcnv4.dll
2009-03-14 12:50 . 2007-01-23 14:40 65,536 --a------ c:\windows\system32\lxddcaps.dll
2009-03-14 12:49 . 2007-02-21 19:11 45,056 --a------ c:\windows\system32\LXF3PMON.DLL
2009-03-14 12:49 . 2006-11-07 06:02 36,864 --a------ c:\windows\system32\lxf3oem.dll
2009-03-14 12:49 . 2007-02-21 19:11 32,768 --a------ c:\windows\system32\LXF3FXPU.DLL
2009-03-14 12:47 . 2009-03-14 12:53 <DIR> d-------- c:\program files\Lexmark Toolbar
2009-03-14 12:47 . 2009-03-14 12:50 <DIR> d-------- c:\program files\Lexmark Fax Solutions
2009-03-14 12:47 . 2006-12-06 00:19 44 --a------ c:\windows\system32\lxddrwrd.ini
2009-03-14 12:45 . 2009-03-14 12:50 <DIR> d-------- c:\program files\Lexmark 2500 Series
2009-03-04 21:10 . 2009-03-04 21:10 <DIR> d-------- c:\program files\MSECache
2009-03-04 20:24 . 2009-03-04 20:36 <DIR> d-------- c:\documents and settings\Owner.BSC\Application Data\U3
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-02 16:23 --------- d--h--w c:\program files\InstallShield Installation Information
2009-04-02 16:23 --------- d-----w c:\program files\CyberLink
2009-04-01 18:15 --------- d-----w c:\program files\Lx_cats
2009-03-29 23:26 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-03-29 01:19 --------- d-----w c:\documents and settings\Owner.BSC\Application Data\Juniper Networks
2009-03-29 01:18 --------- d-----w c:\program files\Google
2009-03-29 01:16 --------- d-----w c:\program files\Common Files\Nullsoft
2009-03-29 01:16 --------- d-----w c:\program files\Common Files\AOL
2009-03-26 16:17 --------- d-----w c:\documents and settings\All Users\Application Data\AOL
2009-03-24 13:57 108,552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-03-21 20:37 325,640 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-03-14 16:52 --------- d-----w c:\documents and settings\Owner.BSC\Application Data\Lexmark Productivity Studio
2009-03-14 16:27 --------- d-----w c:\program files\Yahoo!
2009-03-14 16:27 --------- d-----w c:\program files\Windows Live
2009-03-14 16:27 --------- d-----w c:\program files\QuickTime
2009-03-09 20:46 --------- d-----w c:\documents and settings\Owner.BSC\Application Data\Skype
2009-02-19 14:11 --------- d-----w c:\program files\Logitech
2009-02-19 14:02 --------- d-----w c:\program files\Common Files\FotoWire
2009-02-19 14:02 --------- d-----w c:\documents and settings\Owner.BSC\Application Data\FotoWire
2009-02-19 13:59 81,920 ------r c:\windows\bwUnin-6.1.4.68-8876480L.exe
2009-02-19 13:59 --------- d-----w c:\program files\Common Files\Logitech
2009-01-01 03:38 10,794 --sha-w c:\windows\system32\dipamola.exe
1601-01-01 00:12 10,794 --sha-w c:\windows\system32\folelali.exe
1601-01-01 00:12 3,494 --sha-w c:\windows\system32\guditowi.exe
1601-01-01 00:12 32,694 --sha-w c:\windows\system32\seratewa.exe
1601-01-01 00:12 31,234 --sha-w c:\windows\system32\tagerako.exe
2008-10-14 19:33 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008101420081015\index.dat
2008-10-26 16:51 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008102620081027\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-02-25 966656]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-07 737370]
"DriveIcons"="c:\program files\DriveIcon\DriveIcon.exe" [2006-03-17 655360]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-03-21 1932568]
"lxddmon.exe"="c:\program files\Lexmark 2500 Series\lxddmon.exe" [2007-06-11 291760]
"lxddamon"="c:\program files\Lexmark 2500 Series\lxddamon.exe" [2007-04-30 20480]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2007-06-11 312240]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-04-27 7561216]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-03-21 16:37 10520 c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.enc"= ITIG726.acm
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-13 20:12 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
--a----t- 2008-12-20 16:21 133104 c:\documents and settings\Owner.BSC\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
--a------ 2007-01-01 17:22 3739648 c:\program files\Google\Google Talk\googletalk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-11-20 17:20 290088 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
--a------ 2009-02-19 09:59 20480 c:\program files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechGalleryRepair]
--------- 2004-06-01 12:09 458752 c:\program files\Logitech\Video\ISStart.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
--------- 2004-06-01 06:46 196608 c:\program files\Logitech\Video\ManifestEngine.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
--------- 2004-06-01 12:09 458752 c:\program files\Logitech\Video\ISStart.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
--------- 2004-06-01 12:03 217088 c:\program files\Logitech\Video\LogiTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
--a------ 2004-05-21 20:11 221184 c:\windows\system32\LVCOMSX.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
--a------ 2008-09-19 20:34 4347120 c:\program files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2006-04-27 14:48 7561216 c:\windows\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-11-04 14:30 413696 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SsAAD.exe]
--a------ 2006-05-08 09:17 81920 c:\progra~1\Sony\SONICS~1\SSAAD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-12-06 16:16 136600 c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
--a------ 2005-12-12 19:50 88204 c:\windows\AGRSMMSG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2006-04-27 14:48 1519616 c:\windows\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\lxddcoms.exe"=
"c:\\Program Files\\Lexmark 2500 Series\\lxddamon.exe"=
"c:\\Program Files\\Lexmark 2500 Series\\App4R.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\tibco\\designer\\5.5\\bin\\designer.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\jqs.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\jusched.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\WINDOWS\\ehome\\ehrecvr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddjswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddtime.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\Ymsgr_tray.exe"=
"c:\\Program Files\\Lexmark 2500 Series\\lxddmon.exe"=
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2008-12-20 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-12-20 325640]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-12-20 108552]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-20 298264]
R2 lxdd_device;lxdd_device;c:\windows\system32\lxddcoms.exe -service --> c:\windows\system32\lxddcoms.exe -service [?]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2009-03-26 24652]
S2 lxddCATSCustConnectService;lxddCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxddserv.exe [2009-03-14 99248]
S3 OracleServiceXE;OracleServiceXE;c:\oraclexe\app\oracle\product\10.2.0\server\bin\ORACLE.EXE XE --> c:\oraclexe\app\oracle\product\10.2.0\server\bin\ORACLE.EXE XE [?]
S3 OracleXETNSListener;OracleXETNSListener;c:\oraclexe\app\oracle\product\10.2.0\server\BIN\TNSLSNR.EXE [2006-02-02 204800]
S3 PhilCam8116_XP;Logitech QuickCam Pro 3000(PID_08B1);c:\windows\system32\drivers\CamDrL20.sys [2009-02-19 245760]
S3 TIBCOAdmin-local;TIBCO Administrator 5.4 (local);C:/tibco/administrator/domain/local/bin/tibcoadmin_local.exe --ntservice "TIBCOAdmin-local" --> C:/tibco/administrator/domain/local/bin/tibcoadmin_local.exe --ntservice TIBCOAdmin-local [?]
S3 tibemsd;TIBCO EMS Server;c:\tibco\ems\bin\emsntsct.exe "tibemsd" --> c:\tibco\ems\bin\emsntsct.exe tibemsd [?]
S3 TIBHawkAgent-local-BSC;TIBCO Hawk Agent (local);C:/tibco/tra/domain/local/hawkagent_local.exe --ntservice "TIBHawkAgent-local-BSC" --> C:/tibco/tra/domain/local/hawkagent_local.exe --ntservice TIBHawkAgent-local-BSC [?]
S3 TIBHawkAgent;TIBCO Hawk Agent;c:\tibco\hawk\bin\tibhawkagentnt.exe [2008-10-19 57344]
S3 TIBHawkEvent;TIBCO Hawk Event;c:\tibco\hawk\bin\tibhawkeventnt.exe [2008-10-19 57344]
S3 TIBHawkHMA;TIBCO Hawk HMA;c:\tibco\hawk\bin\tibhawkhma.exe --service TIBHawkHMA --> c:\tibco\hawk\bin\tibhawkhma.exe --service TIBHawkHMA [?]
S4 OracleJobSchedulerXE;OracleJobSchedulerXE;c:\oraclexe\app\oracle\product\10.2.0\server\Bin\extjob.exe XE --> c:\oraclexe\app\oracle\product\10.2.0\server\Bin\extjob.exe XE [?]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e770a3b2-08dd-11de-a70d-00c0a8cbcd3c}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
2009-03-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
2009-04-02 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-28 16:53]
2009-04-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2047258067-2470998688-862904253-1006.job
- c:\documents and settings\Owner.BSC\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-20 16:21]
.
- - - - ORPHANS REMOVED - - - -
BHO-{4089f7d2-2c9e-4633-8c18-3ce2f11462b4} - c:\windows\system32\kifupiza.dll
BHO-{49636E20-1B03-4E81-8B53-546792DCD7EF} - c:\windows\system32\ljJYPgFv.dll
BHO-{5d49cb2f-8e2e-4ce3-8e37-61bbba1a8cec} - c:\windows\system32\devopaha.dll
BHO-{eb2ff624-5964-4940-b6f0-8acfa3b554f4} - c:\windows\system32\vxovls.dll
Notify-byXQhGYP - byXQhGYP.dll
MSConfigStartUp-28eb71b0 - c:\windows\system32\gidogudi.dll
MSConfigStartUp-bopavoluzi - c:\windows\system32\zasezara.dll
MSConfigStartUp-CPM2bd8422c - c:\windows\system32\yopopanu.dll
MSConfigStartUp-Inapusexuyo - c:\windows\Mnelezonusohom.dll
MSConfigStartUp-LogitechCommunicationsManager - c:\program files\Common Files\Logitech\LComMgr\Communications_Helper.exe
MSConfigStartUp-LogitechQuickCamRibbon - c:\program files\Logitech\QuickCam10\QuickCam10.exe
MSConfigStartUp-MsnMsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe
MSConfigStartUp-prunnet - c:\windows\system32\prunnet.exe
MSConfigStartUp-Xmasecedulofo - c:\windows\Pgirivuxeruxi.dat
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = localhost
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Owner.BSC\Application Data\Mozilla\Firefox\Profiles\kmxu4dwd.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - plugin: c:\documents and settings\Owner.BSC\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-02 12:49:44
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TIBCOAdmin-local]
"ImagePath"="C:/tibco/administrator/domain/local/bin/tibcoadmin_local.exe --ntservice \"TIBCOAdmin-local\""
--
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TIBHawkAgent-local-BSC]
"ImagePath"="C:/tibco/tra/domain/local/hawkagent_local.exe --ntservice \"TIBHawkAgent-local-BSC\""
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TIBCOAdmin-local]
"ImagePath"="C:/tibco/administrator/domain/local/bin/tibcoadmin_local.exe --ntservice \"TIBCOAdmin-local\""
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TIBHawkAgent-local-BSC]
"ImagePath"="C:/tibco/tra/domain/local/hawkagent_local.exe --ntservice \"TIBHawkAgent-local-BSC\""
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\lxddcoms.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
c:\windows\ehome\mcrdsvc.exe
c:\windows\ehome\ehmsas.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\dllhost.exe
.
**************************************************************************
.
Completion time: 2009-04-02 12:55:45 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-02 16:55:42
Pre-Run: 45,625,389,056 bytes free
Post-Run: 45,949,505,536 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
341 --- E O F --- 2008-11-12 15:31:15
