ComboFix 07-08-25.2 - "Halvard" 2007-08-26 18:09:15.1 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1044.18.565 [GMT 2:00] * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\HALLI\FAVORI~1\Error Cleaner.url C:\DOCUME~1\HALLI\FAVORI~1\Privacy Protector.url C:\DOCUME~1\HALLI\FAVORI~1\Spyware&Malware Protection.url C:\DOCUME~1\HALLI\PROGRA~1\HbTools C:\DOCUME~1\HALLI\PROGRA~1\HbTools_Icons C:\DOCUME~1\HALLI\SKRIVE~1\Error Cleaner.url C:\DOCUME~1\HALVARD\err.log C:\DOCUME~1\HALVARD\PROGRA~1\HbTools C:\DOCUME~1\HALVARD\PROGRA~1\HbTools_Icons C:\DOCUME~1\Halvard\SKRIVE~1.\Free PC Wallpapers.lnk C:\Programfiler\HbTools C:\Programfiler\HbTools\Bin\4.8.4.0\dBenderC.dll C:\Programfiler\HbTools\Bin\HbtUninst.exe C:\Programfiler\HbTools\HBTV\hbtv_gdf.dat C:\Programfiler\HbTools\HBTV\hbtv_kyf.dat C:\Programfiler\HbTools\HBTV\hbtvau.dat C:\Programfiler\Hotbar C:\Programfiler\VideoAccessCodec C:\Programfiler\VideoAccessCodec\install.ico C:\Programfiler\VideoAccessCodec\Uninstall.exe C:\WINDOWS\dat.txt C:\WINDOWS\rs.txt ((((((((((((((((((((((((( Files Created from 2007-07-26 to 2007-08-26 ))))))))))))))))))))))))))))))) 2007-08-26 18:08 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-26 17:38 d-------- C:\Programfiler\SUPERAntiSpyware 2007-08-26 17:38 d-------- C:\DOCUME~1\Halvard\PROGRA~1\SUPERAntiSpyware.com 2007-08-26 17:38 d-------- C:\DOCUME~1\ALLUSE~1\PROGRA~1\SUPERAntiSpyware.com 2007-08-26 17:30 d-------- C:\Programfiler\RegCure 2007-08-26 16:58 d-------- C:\Programfiler\Trend Micro 2007-08-23 15:34 d-------- C:\Programfiler\Lavasoft 2007-08-23 15:34 d-------- C:\Programfiler\Fellesfiler\Wise Installation Wizard 2007-08-23 15:34 d-------- C:\DOCUME~1\ALLUSE~1\PROGRA~1\Lavasoft 2007-08-22 22:32 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-08-22 22:32 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-08-22 22:32 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-08-22 22:32 783,224 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-08-22 22:32 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-08-22 22:32 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-08-22 22:32 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-08-22 22:31 d-------- C:\Programfiler\Alwil Software 2007-08-21 14:44 d--hs---- C:\FOUND.004 2007-08-14 18:20 d-------- C:\Programfiler\MorpheusBar 2007-08-14 18:18 d-------- C:\Programfiler\Morpheus 2007-07-28 22:57 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-07-28 22:46 d--hs---- C:\FOUND.003 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-22 16:13 103736 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\dllcache\cdm.dll 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\dllcache\wuapi.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\dllcache\wucltui.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\dllcache\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\dllcache\wuaueng.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\dllcache\wups.dll 2007-07-06 12:02 --------- d-------- C:\Programfiler\EuroTalk 2007-07-06 12:02 --------- d-------- C:\DOCUME~1\Halvard\PROGRA~1\EuroTalk 2007-07-06 12:02 --------- d-------- C:\DOCUME~1\HALVARD\PROGRA~1\EuroTalk 2007-06-26 16:15 658432 --------- C:\WINDOWS\system32\dllcache\wininet.dll 2007-06-26 15:57 851968 --------- C:\WINDOWS\system32\dllcache\vgx.dll 2007-06-26 08:10 1104896 --a------ C:\WINDOWS\system32\msxml3.dll 2007-06-26 08:10 1104896 --------- C:\WINDOWS\system32\dllcache\msxml3.dll 2007-06-19 15:33 282112 --a------ C:\WINDOWS\system32\gdi32.dll 2007-06-19 15:33 282112 --------- C:\WINDOWS\system32\dllcache\gdi32.dll 2007-06-14 20:11 96768 --------- C:\WINDOWS\system32\dllcache\inseng.dll 2007-06-14 20:11 615424 --------- C:\WINDOWS\system32\dllcache\urlmon.dll 2007-06-14 20:11 55808 --------- C:\WINDOWS\system32\dllcache\extmgr.dll 2007-06-14 20:11 532480 --------- C:\WINDOWS\system32\dllcache\mstime.dll 2007-06-14 20:11 474112 --------- C:\WINDOWS\system32\dllcache\shlwapi.dll 2007-06-14 20:11 449024 --------- C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-06-14 20:11 39424 --------- C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-06-14 20:11 357888 --------- C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-06-14 20:11 3079680 --------- C:\WINDOWS\system32\dllcache\mshtml.dll 2007-06-14 20:11 251392 --------- C:\WINDOWS\system32\dllcache\iepeers.dll 2007-06-14 20:11 205312 --------- C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-06-14 20:11 16384 --------- C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-06-14 20:11 151552 --------- C:\WINDOWS\system32\dllcache\cdfview.dll 2007-06-14 20:11 1494528 --------- C:\WINDOWS\system32\dllcache\shdocvw.dll 2007-06-14 20:11 146432 --------- C:\WINDOWS\system32\dllcache\msrating.dll 2007-06-14 20:11 1054720 --------- C:\WINDOWS\system32\dllcache\danim.dll 2007-06-14 20:11 1023488 --------- C:\WINDOWS\system32\dllcache\browseui.dll 2007-06-14 16:07 18432 --------- C:\WINDOWS\system32\dllcache\iedw.exe 2007-06-13 15:24 1033216 --a------ C:\WINDOWS\explorer.exe 2007-06-13 15:24 1033216 --------- C:\WINDOWS\system32\dllcache\explorer.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-04-17 05:24] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-27 12:47] "nwiz"="nwiz.exe" [2006-04-27 12:47 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-04-27 12:47] "SMSERIAL"="sm56hlpr.exe" [2006-01-19 23:34 C:\WINDOWS\sm56hlpr.exe] "RTHDCPL"="RTHDCPL.EXE" [2005-12-19 01:52 C:\WINDOWS\RTHDCPL.exe] "ASUS Live Update"="C:\Programfiler\ASUS\ASUS Live Update\ALU.exe" [2006-02-21 15:20] "Wireless Console 2"="C:\Programfiler\Wireless Console 2\wcourier.exe" [2005-10-17 17:09] "SynTPEnh"="C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe" [2005-10-21 02:26] "Zshutdown"="c:\sysprep\patch\sysprep.cmd" [] "RemoteControl"="C:\Programfiler\ASUSTeK\ASUSDVD\PDVDServ.exe" [2004-11-02 20:24] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "Power_Gear"="C:\Programfiler\ASUS\Power4 Gear\BatteryLife.exe" [2006-03-06 17:13] "afrfgjfb"="C:\WINDOWS\system32\zfssfxjx.exe" [] "SunJavaUpdateSched"="C:\Programfiler\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 00:03] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00] "MsnMsgr"="C:\Programfiler\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54] "Skype"="C:\Programfiler\Skype\Phone\Skype.exe" [2006-12-18 17:32] "updateMgr"="c:\Programfiler\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45] "swg"="C:\Programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-19 21:15] "SUPERAntiSpyware"="C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06] C:\DOCUME~1\HALVARD\START-~1\PROGRA~1\OPPSTART\ OpenOffice.org 2.0.lnk - C:\Programfiler\OpenOffice.org 2.0\program\quickstart.exe [2006-06-27 23:58:04] [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] Source= file:///C:\WINDOWS\privacy_danger\index.htm FriendlyName= Privacy Protection [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Programfiler\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Programfiler\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Programfiler\SUPERAntiSpyware\SASWINLO.dll R0 risdptsk;risdptsk;C:\WINDOWS\system32\DRIVERS\risdptsk.sys R3 ASNDIS5;ASNDIS5 Protocol Driver;\??\C:\WINDOWS\system32\ASNDIS5.SYS R3 nvsmu;nvsmu;C:\WINDOWS\system32\DRIVERS\nvsmu.sys R3 SynMini;USB2.0 1.3M Web Cam;C:\WINDOWS\system32\Drivers\SynMini.sys R3 SynScan;USB2.0 1.3M Web Cam Still Image;C:\WINDOWS\system32\Drivers\SynScan.sys S3 hwdatacard;Huawei DataCard USB Modem and USB Serial;C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7ec0825a-0146-11dc-932d-0018f359e60b}] AutoRun\command- F:\AutoRun.exe Contents of the 'Scheduled Tasks' folder 2007-08-26 15:30:28 C:\WINDOWS\Tasks\RegCure.job - C:\Programfiler\RegCure\RegCure.exe 2007-08-26 16:12:30 C:\WINDOWS\Tasks\RegCure Program Check.job ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-26 18:12:39 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Aavmker4] [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\aawservice] "ImagePath"="\"C:\Programfiler\Lavasoft\Ad-Aware 2007\aawservice.exe\"" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{AA4B58E1-2CBD-4651-959F-4039102F8A7D}] Completion time: 2007-08-26 18:13:56 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-26 18:13 --- E O F ---