ComboFix 07-11-08.1 - BOSS 2007-11-15 17:01:37.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.172 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\BOSS\Desktop\CFScript.txt
* Created a new restore point
FILE
C:\Documents and Settings\Guest\Application Data\ntos.exe
C:\MicroSofts.pif
C:\sysalna.exe
C:\WINDOWS\dracee.exe
C:\WINDOWS\draste.exe
C:\WINDOWS\drosmok.exe
C:\WINDOWS\SYSTEM32\gooels.dll
C:\WINDOWS\SYSTEM32\kdfapi.dll
C:\WINDOWS\SYSTEM32\Kdfhok.dll
C:\WINDOWS\SYSTEM32\kdfinj.dll
C:\WINDOWS\SYSTEM32\kdfmgr.exe
C:\WINDOWS\SYSTEM32\kdfvmgr.exe
C:\WINDOWS\SYSTEM32\mscorews.dll
C:\WINDOWS\SYSTEM32\msdtexch.dll
C:\WINDOWS\SYSTEM32\msftedswc.dll
C:\WINDOWS\system32\mskvtns.dll
C:\WINDOWS\SYSTEM32\spoolv.exe
C:\WINDOWS\System32\vvgeowbv.exe
C:\WINDOWS\xlaherx.exe
.
Unable to gain System Privileges
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\{00004495-0000-0000-151A-8F29123B189E}
C:\{00004495-0000-0000-151A-8F29123B189E}\DATA.CAB
C:\{00004495-0000-0000-151A-8F29123B189E}\Manifest.ini
C:\{00004495-0000-0000-151A-8F29123B189E}\Manifest.qrm
C:\{00004528-0000-0000-C9A2-52D0BBE4EFE2}
C:\{00004528-0000-0000-C9A2-52D0BBE4EFE2}\DATA.CAB
C:\{00004528-0000-0000-C9A2-52D0BBE4EFE2}\Manifest.ini
C:\{00004528-0000-0000-C9A2-52D0BBE4EFE2}\Manifest.qrm
C:\{00004676-0000-0000-FD5B-BAA2F545B743}
C:\{00004676-0000-0000-FD5B-BAA2F545B743}\DATA.CAB
C:\{00004676-0000-0000-FD5B-BAA2F545B743}\Manifest.ini
C:\{00004676-0000-0000-FD5B-BAA2F545B743}\Manifest.qrm
C:\{8001B643-0000-0000-893B-01B02CF26B97}
C:\{8001B643-0000-0000-893B-01B02CF26B97}\DATA.CAB
C:\{8001B643-0000-0000-893B-01B02CF26B97}\Manifest.ini
C:\{8001B643-0000-0000-893B-01B02CF26B97}\Manifest.qrm
C:\c9504ee262b6c366af16\$shtdwn$.req
C:\c9504ee262b6c366af16\atl80.dll
C:\c9504ee262b6c366af16\cert.dll
C:\c9504ee262b6c366af16\conflictingappmodule.dll
C:\c9504ee262b6c366af16\de-at\
C:\c9504ee262b6c366af16\de-ch\
C:\c9504ee262b6c366af16\de-de\
C:\c9504ee262b6c366af16\en-au\
C:\c9504ee262b6c366af16\en-ca\
C:\c9504ee262b6c366af16\en-gb\
C:\c9504ee262b6c366af16\en-ie\
C:\c9504ee262b6c366af16\en-nz\
C:\c9504ee262b6c366af16\en-sg\
C:\c9504ee262b6c366af16\es-es\
C:\c9504ee262b6c366af16\es-mx\
C:\c9504ee262b6c366af16\es-us\
C:\c9504ee262b6c366af16\eula.rtf
C:\c9504ee262b6c366af16\fo-fo\
C:\c9504ee262b6c366af16\fr-be\
C:\c9504ee262b6c366af16\fr-ca\
C:\c9504ee262b6c366af16\fr-ch\
C:\c9504ee262b6c366af16\fr-fr\
C:\c9504ee262b6c366af16\it-it\
C:\c9504ee262b6c366af16\ja-jp\
C:\c9504ee262b6c366af16\ko-kr\
C:\c9504ee262b6c366af16\microsoft.vc80.atl.manifest
C:\c9504ee262b6c366af16\microsoft.vc80.crt.manifest
C:\c9504ee262b6c366af16\msvcp80.dll
C:\c9504ee262b6c366af16\msvcr80.dll
C:\c9504ee262b6c366af16\nl-be\
C:\c9504ee262b6c366af16\nl-nl\
C:\c9504ee262b6c366af16\ocsetup.exe
C:\c9504ee262b6c366af16\ocsetupro.dll
C:\c9504ee262b6c366af16\service.xml
C:\c9504ee262b6c366af16\winsscommon.dll
C:\c9504ee262b6c366af16\winssplatform.dll
C:\c9504ee262b6c366af16\zh-mo\
C:\ce1f38489d672d29afffcbf2900fb7\update\
C:\Documents and Settings\Guest\Application Data\ntos.exe
C:\MicroSofts.pif
C:\Program Files\Free Offers from Freeze.com
C:\Program Files\Free Offers from Freeze.com\bingocafe.ico
C:\Program Files\Free Offers from Freeze.com\bingocafe.url
C:\Program Files\Free Offers from Freeze.com\control.txt
C:\Program Files\Free Offers from Freeze.com\FreeRingtones.ico
C:\Program Files\Free Offers from Freeze.com\FreeRingtones.url
C:\Program Files\Free Offers from Freeze.com\PartyPoker.ico
C:\Program Files\Free Offers from Freeze.com\PartyPoker.url
C:\Program Files\Free Offers from Freeze.com\registryCleaner.url
C:\Program Files\Free Offers from Freeze.com\wfallsaw.url
C:\Program Files\Gvqnjbaj
C:\Program Files\Larlpqyh
C:\sysalna.exe
C:\WINDOWS\dracee.exe
C:\WINDOWS\draste.exe
C:\WINDOWS\drosmok.exe
C:\WINDOWS\kdefense
C:\WINDOWS\kdefense\k52010.ico
C:\WINDOWS\kdefense\k52011.ico
C:\WINDOWS\kdefense\k52012.bmp
C:\WINDOWS\kdefense\KStartClean.ini
C:\WINDOWS\Media\
C:\WINDOWS\Media\\CHIMES.WAV
C:\WINDOWS\Media\\CHORD.WAV
C:\WINDOWS\Media\\DING.WAV
C:\WINDOWS\Media\\FLOURISH.MID
C:\WINDOWS\Media\\NOTIFY.WAV
C:\WINDOWS\Media\\ONESTOP.MID
C:\WINDOWS\Media\\RECYCLE.WAV
C:\WINDOWS\Media\\RINGIN.WAV
C:\WINDOWS\Media\\RINGOUT.WAV
C:\WINDOWS\Media\\SendMail.dll
C:\WINDOWS\Media\\START.WAV
C:\WINDOWS\Media\\TADA.WAV
C:\WINDOWS\Media\\TOWN.MID
C:\WINDOWS\Media\\Windows Feed Discovered.wav
C:\WINDOWS\Media\\Windows Information Bar.wav
C:\WINDOWS\Media\\Windows Navigation Start.wav
C:\WINDOWS\Media\\Windows Pop-up Blocked.wav
C:\WINDOWS\Media\\Windows XP Balloon.wav
C:\WINDOWS\Media\\Windows XP Battery Critical.wav
C:\WINDOWS\Media\\Windows XP Battery Low.wav
C:\WINDOWS\Media\\Windows XP Critical Stop.wav
C:\WINDOWS\Media\\Windows XP Default.wav
C:\WINDOWS\Media\\Windows XP Ding.wav
C:\WINDOWS\Media\\Windows XP Error.wav
C:\WINDOWS\Media\\Windows XP Exclamation.wav
C:\WINDOWS\Media\\Windows XP Hardware Fail.wav
C:\WINDOWS\Media\\Windows XP Hardware Insert.wav
C:\WINDOWS\Media\\Windows XP Hardware Remove.wav
C:\WINDOWS\Media\\windows xp information bar.wav
C:\WINDOWS\Media\\Windows XP Logoff Sound.wav
C:\WINDOWS\Media\\Windows XP Logon Sound.wav
C:\WINDOWS\Media\\Windows XP Menu Command.wav
C:\WINDOWS\Media\\Windows XP Minimize.wav
C:\WINDOWS\Media\\Windows XP Notify.wav
C:\WINDOWS\Media\\windows xp pop-up blocked.wav
C:\WINDOWS\Media\\Windows XP Print complete.wav
C:\WINDOWS\Media\\Windows XP Recycle.wav
C:\WINDOWS\Media\\Windows XP Restore.wav
C:\WINDOWS\Media\\Windows XP Ringin.wav
C:\WINDOWS\Media\\Windows XP Ringout.wav
C:\WINDOWS\Media\\Windows XP Shutdown.wav
C:\WINDOWS\Media\\Windows XP Start.wav
C:\WINDOWS\Media\\Windows XP Startup.wav
C:\WINDOWS\SYSTEM32\DRIVERS\neokdss.sys
C:\WINDOWS\SYSTEM32\gooels.dll
C:\WINDOWS\SYSTEM32\kdfapi.dll
C:\WINDOWS\SYSTEM32\Kdfhok.dll
C:\WINDOWS\SYSTEM32\kdfinj.dll
C:\WINDOWS\SYSTEM32\kdfmgr.exe
C:\WINDOWS\SYSTEM32\kdfvmgr.exe
C:\WINDOWS\SYSTEM32\mscorews.dll
C:\WINDOWS\SYSTEM32\msdtexch.dll
C:\WINDOWS\SYSTEM32\msftedswc.dll
C:\WINDOWS\system32\noskrnl.sys
C:\WINDOWS\system32\ntos.exe
C:\WINDOWS\SYSTEM32\spoolv.exe
C:\WINDOWS\system32\wsnpoem
C:\WINDOWS\xlaherx.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_NOSKRNL.SYS
-------\noskrnl.sys
((((((((((((((((((((((((( Files Created from 2007-10-15 to 2007-11-15 )))))))))))))))))))))))))))))))
.
2007-11-14 18:46 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-14 09:24 <DIR> d-------- C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-11-14 09:24 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-11-13 18:04 289,144 --a------ C:\WINDOWS\SYSTEM32\VCCLSID.exe
2007-11-13 18:04 288,417 --a------ C:\WINDOWS\SYSTEM32\SrchSTS.exe
2007-11-13 18:04 53,248 --a------ C:\WINDOWS\SYSTEM32\Process.exe
2007-11-13 18:04 25,600 --a------ C:\WINDOWS\SYSTEM32\WS2Fix.exe
2007-11-12 20:46 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
2007-11-12 20:33 <DIR> d-------- C:\WINDOWS\Sun
2007-11-12 18:55 3,056 --a------ C:\WINDOWS\SYSTEM32\tmp.reg
2007-11-12 18:51 289,280 --a------ C:\WINDOWS\SYSTEM32\libcurl.dll
2007-11-12 18:48 <DIR> d-------- C:\WINDOWS\SYSTEM32\Log
2007-11-12 11:23 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-11-12 08:51 10,752 --a------ C:\WINDOWS\DCEBoot.exe
2007-11-12 08:06 <DIR> d-------- C:\Program Files\Java
2007-11-12 08:05 <DIR> d-------- C:\Program Files\Common Files\Java
2007-11-11 01:46 <DIR> d-------- C:\Program Files\a-squared Free
2007-11-09 10:53 <DIR> d-------- C:\Program Files\ACW
2007-11-09 10:01 <DIR> d-------- C:\WINDOWS\LocalSSL
2007-11-09 09:57 138,512 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\tmcomm.sys
2007-11-09 09:57 52,496 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\tmactmon.sys
2007-11-09 09:57 52,368 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\tmevtmgr.sys
2007-11-08 17:39 <DIR> d-------- C:\Documents and Settings\BOSS\Application Data\Yahoo!
2007-11-08 17:39 <DIR> d-------- C:\DOCUME~1\BOSS\APPLIC~1\Yahoo!
2007-11-08 00:52 <DIR> d-------- C:\Program Files\Trend Micro
2007-11-04 09:40 <DIR> d-------- C:\Program Files\Windows Desktop Search
2007-11-04 09:35 <DIR> d-------- C:\Program Files\Windows Live Favorites
2007-11-04 09:31 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
2007-11-04 09:30 <DIR> d-------- C:\Program Files\Windows Live Toolbar
2007-11-02 20:22 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trend Micro
2007-11-02 10:28 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2007-11-02 04:17 128,896 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\fltmgr.sys
2007-11-02 04:17 23,040 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\fltmc.exe
2007-11-02 04:17 16,896 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\fltlib.dll
2007-11-02 04:15 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-11-02 02:21 582,656 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\rpcrt4.dll
2007-11-02 00:56 459,264 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msfeeds.dll
2007-11-02 00:56 267,776 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\iertutil.dll
2007-11-02 00:56 52,224 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msfeedsbs.dll
2007-11-02 00:55 6,058,496 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll
2007-11-02 00:55 2,455,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dat
2007-11-02 00:55 383,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dll
2007-11-02 00:55 63,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\icardie.dll
2007-11-02 00:55 33,792 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\custsat.dll
2007-11-02 00:55 13,824 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
2007-11-02 00:19 <DIR> d-------- C:\Security
2007-11-01 20:26 <DIR> d-------- C:\WINDOWS\provisioning
2007-11-01 20:26 <DIR> d-------- C:\WINDOWS\peernet
2007-11-01 20:22 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2007-11-01 20:08 <DIR> d-------- C:\WINDOWS\EHome
2007-11-01 16:48 11,776 --a------ C:\WINDOWS\SYSTEM32\spnpinst.exe
2007-11-01 16:48 4,569 --a------ C:\WINDOWS\SYSTEM32\secupd.dat
2007-11-01 13:25 614,912 --a------ C:\WINDOWS\SYSTEM32\h323msp.dll
2007-11-01 13:25 331,264 --a------ C:\WINDOWS\SYSTEM32\ipnathlp.dll
2007-11-01 13:25 40,960 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\evtgprov.dll
2007-11-01 13:11 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-11-01 11:44 <DIR> d-------- C:\Program Files\Symantec
2007-11-01 11:44 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2007-11-01 11:44 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-11-01 09:28 1,082,368 --a------ C:\WINDOWS\SYSTEM32\esent.dll
2007-11-01 09:06 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-11-01 09:06 22,752 --a------ C:\WINDOWS\SYSTEM32\spupdsvc.exe
2007-11-01 09:04 <DIR> d-------- C:\WINDOWS\SYSTEM32\bits
2007-11-01 09:03 351,232 --a------ C:\WINDOWS\SYSTEM32\winhttp.dll
2007-11-01 09:03 18,944 --a------ C:\WINDOWS\SYSTEM32\qmgrprxy.dll
2007-11-01 09:03 8,192 --a------ C:\WINDOWS\SYSTEM32\bitsprx2.dll
2007-11-01 09:03 7,168 --a------ C:\WINDOWS\SYSTEM32\bitsprx3.dll
2007-11-01 09:00 271,224 --a------ C:\WINDOWS\SYSTEM32\mucltui.dll
2007-11-01 08:59 549,720 --a------ C:\WINDOWS\SYSTEM32\wuapi.dll
2007-11-01 08:59 325,976 --a------ C:\WINDOWS\SYSTEM32\wucltui.dll
2007-11-01 08:59 43,352 --a------ C:\WINDOWS\SYSTEM32\wups2.dll
2007-11-01 08:59 33,624 --a------ C:\WINDOWS\SYSTEM32\wups.dll
2007-11-01 08:23 4 --a------ C:\WINDOWS\SYSTEM32\stfv.bin
2007-11-01 08:02 <DIR> d-------- C:\Program Files\Jnoncjpv
2007-11-01 08:02 12 --a------ C:\WINDOWS\SYSTEM32\dpqaqlqx.bin
2007-11-01 08:01 <DIR> d-------- C:\Program Files\xcjyzgta
2007-11-01 07:59 <DIR> d-------- C:\WINDOWS\SYSTEM32\Mz08r
2007-11-01 07:59 <DIR> d-------- C:\Temp\mZOr
2007-11-01 00:06 15,452,536 --a------ C:\IE7-WindowsXP-x86-enu.exe
2007-10-30 14:29 <DIR> d-------- C:\Program Files\QdrModule
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-14 06:42 --------- d-----w C:\Program Files\Lx_cats
2007-11-12 16:02 --------- d-----w C:\Program Files\SBC Yahoo!
2007-11-12 16:02 --------- d-----w C:\Program Files\SBC Self Support Tool
2007-11-12 16:02 --------- d-----w C:\Program Files\ReadIris
2007-11-12 16:02 --------- d-----w C:\Program Files\QuickTime
2007-11-12 16:01 --------- d-----w C:\Program Files\MSN Messenger
2007-11-12 16:01 --------- d-----w C:\Program Files\Modem Helper
2007-11-12 16:01 --------- d-----w C:\Program Files\Microsoft Works
2007-11-12 16:01 --------- d-----w C:\Program Files\Microsoft Streets & Trips
2007-11-12 16:01 --------- d-----w C:\Program Files\Microsoft Picture It! 7
2007-11-12 15:59 --------- d-----w C:\Program Files\Lexmark 7300 Series
2007-11-12 15:57 --------- d-----w C:\Program Files\Digital Line Detect
2007-11-12 15:56 --------- d-----w C:\Program Files\Common Files\Motive
2007-11-12 15:54 --------- d-----w C:\Program Files\2Wire
2007-11-11 01:18 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
2007-11-09 00:43 --------- d-----w C:\Program Files\Real
2007-11-09 00:43 --------- d-----w C:\Program Files\Common Files\Real
2007-11-09 00:28 --------- d-----w C:\Program Files\The Print Shop 20
2007-11-08 23:33 --------- d-----w C:\Program Files\Web Publish
2007-11-04 00:58 --------- d-----w C:\Documents and Settings\Guest\Application Data\Yahoo!
2007-11-01 17:26 --------- d-----w C:\Program Files\Yahoo!
2007-11-01 01:56 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg7
2007-11-01 00:19 --------- d-----w C:\Program Files\Viewpoint
2007-10-26 03:34 8,460,288 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\shell32.dll
2007-10-11 01:51 --------- d-----w C:\Program Files\MySpace
2007-09-18 08:31 65,936 ----a-w C:\WINDOWS\system32\drivers\tmtdi.sys
2007-09-18 08:31 36,112 ----a-w C:\WINDOWS\system32\drivers\tmpreflt.sys
2007-09-18 08:31 333,328 ----a-w C:\WINDOWS\system32\drivers\TM_CFW.sys
2007-09-18 08:31 203,024 ----a-w C:\WINDOWS\system32\drivers\tmxpflt.sys
2007-09-18 08:31 1,126,328 ----a-w C:\WINDOWS\system32\drivers\vsapint.sys
2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\SYSTEM32\inetcomm.dll
2007-08-21 06:15 683,520 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\inetcomm.dll
2007-08-20 21:34 3,584,512 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2007-08-20 10:04 824,832 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll
2007-08-20 10:04 671,232 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mstime.dll
2007-08-20 10:04 477,696 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtmled.dll
2007-08-20 10:04 44,544 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iernonce.dll
2007-08-20 10:04 384,512 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iedkcs32.dll
2007-08-20 10:04 27,648 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\jsproxy.dll
2007-08-20 10:04 232,960 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\webcheck.dll
2007-08-20 10:04 230,400 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieaksie.dll
2007-08-20 10:04 214,528 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtrans.dll
2007-08-20 10:04 193,024 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\msrating.dll
2007-08-20 10:04 153,088 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakeng.dll
2007-08-20 10:04 132,608 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\extmgr.dll
2007-08-20 10:04 124,928 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\advpack.dll
2007-08-20 10:04 105,984 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\url.dll
2007-08-20 10:04 102,400 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\occache.dll
2007-08-20 10:04 1,152,000 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\urlmon.dll
2007-08-17 10:21 625,152 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe
2007-08-17 10:20 63,488 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe
2007-08-17 07:34 161,792 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll
2006-09-01 01:19 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2007-06-23 07:16:26 8,675 --sha-w C:\WINDOWS\SYSTEM32\ospcont.dat
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of C:\Program Files\ACW ----
2007-11-09 10:54 610173 --a------ C:\Program Files\ACW\ACWRuntimesCab
2007-11-09 10:54 1945 --a------ C:\Program Files\ACW\ACWExt.xml
2006-06-08 17:41 769312 --a------ C:\Program Files\ACW\ActiveContentWizard.dll
2006-06-08 17:41 164640 --a------ C:\Program Files\ACW\ACW.exe
2006-06-08 17:37 322336 --a------ C:\Program Files\ACW\AcwPSSExtn.dll
---- Directory of C:\Security ----
2007-11-02 02:37 8706680 --a------ C:\Security\Windows-KB890830-V1.34.exe
2007-11-02 00:48 15452536 --a------ C:\Security\IE7-WindowsXP-x86-enu.exe
2007-11-02 00:20 5154304 --a------ C:\Security\WindowsDefender.msi
((((((((((((((((((((((((((((( snapshot@2007-11-14_19.26.48.88 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-09 00:47:24 12,288 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2007-11-15 08:22:42 12,288 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2007-11-09 00:47:24 135,168 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2007-11-15 08:22:41 135,168 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2007-11-09 00:47:24 11,264 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2007-11-15 08:22:42 11,264 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2007-11-09 00:47:24 27,136 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2007-11-15 08:22:42 27,136 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2007-11-09 00:47:24 4,096 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2007-11-15 08:22:42 4,096 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2007-11-09 00:47:24 794,624 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2007-11-15 08:22:42 794,624 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2007-11-09 00:47:24 249,856 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2007-11-15 08:22:42 249,856 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2007-11-09 00:47:24 23,040 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2007-11-15 08:22:42 23,040 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2007-11-09 00:47:24 286,720 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2007-11-15 08:22:41 286,720 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2007-11-09 00:47:24 409,600 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2007-11-15 08:22:41 409,600 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2007-11-15 01:20:42 32,768 ----a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\INDEX.DAT
+ 2007-11-15 19:58:59 32,768 ----a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\INDEX.DAT
- 2007-11-15 01:20:42 32,768 ----a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\INDEX.DAT
+ 2007-11-15 19:58:59 32,768 ----a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\INDEX.DAT
- 2007-11-15 01:20:42 229,376 ----a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2007-11-15 19:58:59 229,376 ----a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2007-09-28 04:19:40 18,089,592 ----a-w C:\WINDOWS\SYSTEM32\MRT.exe
+ 2007-11-02 07:12:57 18,238,072 ----a-w C:\WINDOWS\SYSTEM32\MRT.exe
- 2006-12-19 21:52:18 8,453,632 ----a-w C:\WINDOWS\SYSTEM32\shell32.dll
+ 2007-10-26 03:34:01 8,460,288 ----a-w C:\WINDOWS\SYSTEM32\shell32.dll
- 2007-03-06 01:22:36 14,048 ------w C:\WINDOWS\SYSTEM32\spmsg.dll
+ 2007-03-06 01:22:33 14,048 ------w C:\WINDOWS\SYSTEM32\spmsg.dll
- 2007-06-19 07:24:36 350,720 ----a-w C:\WINDOWS\SYSTEM32\xpsp3res.dll
+ 2007-10-29 10:04:03 350,720 ----a-w C:\WINDOWS\SYSTEM32\xpsp3res.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{029e02f0-a0e5-4b19-b958-7bf2db29fb13}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6abc861a-31e7-4d91-b43b-d3c98f22a5c0}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a4a435cf-3583-11d4-91bd-0048546a1450}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A6E432B4-D4C2-43B3-BF55-C364F8F7362A}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C222CF73-124F-3562-44AC-E685D962C63C}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c2680e10-1655-4a0e-87f8-4259325a84b7}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c4ca6559-2cf1-48b6-96b2-8340a06fd129}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d8efadf1-9009-11d6-8c73-608c5dc19089}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DABCE839-3831-3818-AF3A-3837BCD324D2}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9306072-417e-43e3-81d5-369490beef7c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{E7620C98-FCCC-40E5-92EC-C7685D2E1E40}"= C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll [2007-09-16 08:21 103760]
[HKEY_CLASSES_ROOT\CLSID\{E7620C98-FCCC-40E5-92EC-C7685D2E1E40}]
[HKEY_CLASSES_ROOT\TSToolbar.TSProtectorBar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EC525605-2266-4775-8F78-A68A6446465C}]
[HKEY_CLASSES_ROOT\TSToolbar.TSProtectorBar]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"sr1exe"="C:\Documents and Settings\All Users\Application Data\Dell\Alert\252\updtSup3.exe" [2003-05-15 14:21]
"YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 16:19]
"YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2007-06-26 13:48]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"UfSeAgnt.exe"="C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe" [2007-09-18 02:31]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"SpybotDeletingC4953"=cmd /c del "C:\Documents and Settings\BOSS\Local Settings\Temp\~DFD9B.tmp"
"SpybotDeletingC6542"=cmd /c del "C:\WINDOWS\pbsysie.dll"
"SpybotDeletingA7013"=command /c del "C:\Documents and Settings\BOSS\Local Settings\Temp\~DFD9B.tmp"
"SpybotDeletingA6499"=command /c del "C:\WINDOWS\pbsysie.dll"
C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
SBC Self Support Tool.lnk - C:\Program Files\SBC Self Support Tool\bin\matcli.exe [2005-01-03 22:59:00]
Windows Desktop Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2006-03-26 22:44:08]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2006-03-13 13:11 233472]
S4 lxci_device;lxci_device;C:\WINDOWS\System32\lxcicoms.exe -service
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-11-15 17:20:17
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-11-15 17:23:38 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-14 19:28
.
--- E O F ---