|
ComboFix 09-03-04.01 - WS 2009-03-06 12:12:05.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.2047.1546 [GMT 1:00]
Running from: c:\documents and settings\WS\My Documents\C-F.exe
Command switches used :: c:\documents and settings\WS\Desktop\CFScript.txt
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
c:\documents and settings\WS\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\WS\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
.
((((((((((((((((((((((((( Files Created from 2009-02-06 to 2009-03-06 )))))))))))))))))))))))))))))))
.
2009-03-04 21:39 . 2009-03-04 21:58 <DIR> d-------- c:\program files\Opera
2009-03-03 19:02 . 2009-03-05 19:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\SecTaskMan
2009-02-25 15:44 . 2009-02-25 15:44 <DIR> d-------- c:\documents and settings\LocalService\Application Data\GameTracker
2009-02-16 19:23 . 2009-02-16 19:23 <DIR> d-------- c:\documents and settings\WS\Application Data\Malwarebytes
2009-02-16 19:23 . 2009-02-16 19:23 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-16 19:17 . 2009-03-03 20:09 3,553 --a------ c:\windows\system32\%LocalXml%
2009-02-16 18:46 . 2009-02-16 19:17 101,287 --a------ c:\windows\system32\drivers\klin.dat
2009-02-16 18:46 . 2009-02-16 19:17 89,601 --a------ c:\windows\system32\drivers\klick.dat
2009-02-16 18:33 . 2009-02-16 18:33 <DIR> d-------- c:\program files\Kaspersky Lab
2009-02-16 18:33 . 2009-03-06 12:07 <DIR> d-------- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-02-16 18:33 . 2009-03-06 12:05 3,340,320 --ahs---- c:\windows\system32\drivers\fidbox.dat
2009-02-16 18:33 . 2009-03-06 12:12 491,552 --ahs---- c:\windows\system32\drivers\fidbox2.dat
2009-02-16 18:33 . 2009-03-06 12:05 28,224 --ahs---- c:\windows\system32\drivers\fidbox.idx
2009-02-16 18:33 . 2009-03-06 12:11 3,780 --ahs---- c:\windows\system32\drivers\fidbox2.idx
2009-02-16 17:35 . 2009-03-03 21:27 <DIR> d-------- c:\program files\Kaspersky
2009-02-14 18:45 . 2009-02-14 18:45 <DIR> d-------- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-03 20:14 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-03 20:12 --------- d-----w c:\program files\BearShare Applications
2009-03-03 20:11 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-03-03 01:59 33,808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-03-03 00:56 --------- d-----w c:\program files\Google
2009-03-01 04:34 --------- d-----w c:\documents and settings\WS\Application Data\uTorrent
2009-02-16 17:30 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-02-16 17:30 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-02 19:43 --------- d-----w c:\program files\Counter-Strike 1.6
2009-02-02 17:45 --------- d-----w c:\program files\AskBarDis
2009-02-02 17:07 --------- d-----w c:\program files\Cheating-Death
2009-01-29 22:02 --------- d-----w c:\documents and settings\All Users\Application Data\GRETECH
2009-01-29 22:01 --------- d-----w c:\documents and settings\WS\Application Data\GRETECH
2009-01-29 22:00 --------- d-----w c:\program files\GRETECH
2009-01-29 21:59 --------- d-----w c:\program files\AskSearch
2009-01-27 18:13 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2009-01-27 18:02 --------- d-----w c:\program files\Team JPN
2009-01-23 23:38 138,184 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-01-23 23:37 183,112 ----a-w c:\windows\system32\PnkBstrB.exe
2009-01-20 21:30 --------- d-----w c:\documents and settings\WS\Application Data\BSplayer PRO
2009-01-18 21:39 --------- d-----w c:\program files\GameSpy Arcade
2009-01-16 22:22 --------- d-----w c:\program files\Valve
2009-01-14 20:49 --------- d-----w c:\documents and settings\WS\Application Data\Sony Corporation
2009-01-14 20:41 --------- d-----w c:\program files\Sony
2009-01-14 19:15 --------- d-----w c:\program files\Windows Media Connect 2
2009-01-11 01:14 --------- d-----w c:\program files\MSXML 6.0
2009-01-11 01:12 --------- d-----w c:\program files\MSXML 4.0
2009-01-06 18:39 --------- d-----w c:\program files\directx
2009-01-06 18:34 --------- d-----w c:\program files\Infogrames
2009-01-05 17:09 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-12-06 15:05 66,872 ----a-w c:\windows\system32\PnkBstrA.exe
2008-12-02 21:14 24,192 ----a-w c:\documents and settings\WS\usbsermptxp.sys
2008-12-02 21:14 22,768 ----a-w c:\documents and settings\WS\usbsermpt.sys
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\documents and settings\All Users\Application Data\SecTaskMan ----
2009-03-03 19:02 964 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_D6461317C3DC4F04799BDCE9E42626FE
2009-03-03 19:02 960 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_46A41BC84FECF8C41B8CC1B37825BC55.dll
2009-03-03 19:02 905 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_46A41BC84FECF8C41B8CC1B37825BC55
2009-03-03 19:02 88 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_EB940C659E972054EB7A79453A6EF0B9.dll
2009-03-03 19:02 878 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_06AFBA4AE8ED7324DB9F0451EF76A31D.dll
2009-03-03 19:02 858 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_297DD19418DAC924E94B68DDD3223E33.dll
2009-03-03 19:02 81 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_997C1B3D37BCED24ABF0324497A390C5.dll
2009-03-03 19:02 79 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_B982047C09CF839D3871F1EFFBC740BD.dll
2009-03-03 19:02 7832 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_951EFF34991388141ADC261966DA0133.dll
2009-03-03 19:02 762 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_12D51E00B86B4C7D75B436E6D2E1ECEB.dll
2009-03-03 19:02 73 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_2CE27694B1714B74C87E057D0836067D.dll
2009-03-03 19:02 703 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_06AFBA4AE8ED7324DB9F0451EF76A31D
2009-03-03 19:02 6883 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_A140110900063D11C8EF10054038389C.dll
2009-03-03 19:02 687 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_1EF22D6EF5BAAC244908F6079BD6DD88
2009-03-03 19:02 666 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_68AB67CA7DA73301B7448A0000000020
2009-03-03 19:02 662 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_0F007175D9BDA3B40BD3531AB45B39F9
2009-03-03 19:02 654 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_F4B3F628795CD1FAC41BF244B18E2EFB
2009-03-03 19:02 654 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_297DD19418DAC924E94B68DDD3223E33
2009-03-03 19:02 653 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_68AB67CA7DA73301B7448A0000000020.dll
2009-03-03 19:02 638 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_B7FFF0ADD9AD2A643A927808E4AC85AE
2009-03-03 19:02 620 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_62287FAB00234BD4EB33D429A2978904
2009-03-03 19:02 589 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_3FB590517D3AFDD41B39A39486180E30
2009-03-03 19:02 574 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_B3110ECE0D328DD4986E2D0F62ACFB30
2009-03-03 19:02 57 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_420BC2BF090880146AC0C1C6354E9D9C.dll
2009-03-03 19:02 565 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_997C1B3D37BCED24ABF0324497A390C5
2009-03-03 19:02 563 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_382BBE58FA5635C4E9EBC7A03272267F
2009-03-03 19:02 561 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_B982047C09CF839D3871F1EFFBC740BD
2009-03-03 19:02 558 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_DB58B1D770AA8B8408D8764A60F76CDB
2009-03-03 19:02 558 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_D139E7FE48CDB174D86B8A3385904547
2009-03-03 19:02 557 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_29602B78D9E90EAF677C7EE5C37C0B1D
2009-03-03 19:02 557 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_18E47D93DED5EE7C8870198A082021AF
2009-03-03 19:02 554 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_4EA42A62D9304AC4784BF238120611FF
2009-03-03 19:02 55 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_7FB8A03FC8820C7553E7D676BB966428.dll
2009-03-03 19:02 543 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_2CE27694B1714B74C87E057D0836067D
2009-03-03 19:02 540 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_0337C6624F0C5E94F8025AF6F9288257
2009-03-03 19:02 539 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_DDA39468D428E8B4DB27C8D5DC5CA217
2009-03-03 19:02 538 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_F94EC9297AC13FC49A1AD65747346CF3
2009-03-03 19:02 538 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_E3124E1ADA6085C43851291F51139D06
2009-03-03 19:02 538 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_BBE47BEE4B44BFC4EB1EF1B319891D84
2009-03-03 19:02 538 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_6F9E66FF7E38E3A3FA41D89E8A906A4A
2009-03-03 19:02 534 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_52210C14DF54ECB7E1AD7F5E9054DA7D
2009-03-03 19:02 5299 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_12341rg
2009-03-03 19:02 522 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_FC34545F37CE748D7108486A24E02A92
2009-03-03 19:02 522 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_EB96792CFDEBE9CD769AE5A7FE0F93FC
2009-03-03 19:02 522 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_EB940C659E972054EB7A79453A6EF0B9
2009-03-03 19:02 522 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_7FB8A03FC8820C7553E7D676BB966428
2009-03-03 19:02 522 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_566F07119532934EB55C39B27824E31F
2009-03-03 19:02 522 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_4921E8E515979AD6011F8C777831643F
2009-03-03 19:02 522 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_420BC2BF090880146AC0C1C6354E9D9C
2009-03-03 19:02 522 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_12D51E00B86B4C7D75B436E6D2E1ECEB
2009-03-03 19:02 522 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_0B79C053C7D38EE4AB9A00CB3B5D2472
2009-03-03 19:02 522 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_096825A1D2A65CB41B34C8A48E1DD969
2009-03-03 19:02 520 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_E3124E1ADA6085C43851291F51139D06.dll
2009-03-03 19:02 457 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_FC34545F37CE748D7108486A24E02A92.dll
2009-03-03 19:02 4361 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_12345db
2009-03-03 19:02 41 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_096825A1D2A65CB41B34C8A48E1DD969.dll
2009-03-03 19:02 3895 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_D6461317C3DC4F04799BDCE9E42626FE.dll
2009-03-03 19:02 386 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_B3110ECE0D328DD4986E2D0F62ACFB30.dll
2009-03-03 19:02 3271 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_F4B3F628795CD1FAC41BF244B18E2EFB.dll
2009-03-03 19:02 312 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_E8248885C99617E4FB1749EE604B79AD.dll
2009-03-03 19:02 312 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_37259496CDCF68A4CB7B945B403DBFE0.dll
2009-03-03 19:02 3082 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_29602B78D9E90EAF677C7EE5C37C0B1D.dll
2009-03-03 19:02 287 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_1EF22D6EF5BAAC244908F6079BD6DD88.dll
2009-03-03 19:02 270 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_F94EC9297AC13FC49A1AD65747346CF3.dll
2009-03-03 19:02 27 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_4EA42A62D9304AC4784BF238120611FF.dll
2009-03-03 19:02 26 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_D139E7FE48CDB174D86B8A3385904547.dll
2009-03-03 19:02 222 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_DB58B1D770AA8B8408D8764A60F76CDB.dll
2009-03-03 19:02 217 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_B7FFF0ADD9AD2A643A927808E4AC85AE.dll
2009-03-03 19:02 1774 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_951EFF34991388141ADC261966DA0133
2009-03-03 19:02 176 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_BBE47BEE4B44BFC4EB1EF1B319891D84.dll
2009-03-03 19:02 172 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_0337C6624F0C5E94F8025AF6F9288257.dll
2009-03-03 19:02 1654 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_52210C14DF54ECB7E1AD7F5E9054DA7D.dll
2009-03-03 19:02 152 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_DDA39468D428E8B4DB27C8D5DC5CA217.dll
2009-03-03 19:02 1360 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_62287FAB00234BD4EB33D429A2978904.dll
2009-03-03 19:02 1307 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_A140110900063D11C8EF10054038389C
2009-03-03 19:02 1175 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_6F9E66FF7E38E3A3FA41D89E8A906A4A.dll
2009-03-03 19:02 1172 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_0F007175D9BDA3B40BD3531AB45B39F9.dll
2009-03-03 19:02 1159 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_3FB590517D3AFDD41B39A39486180E30.dll
2009-03-03 19:02 1103 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_E8248885C99617E4FB1749EE604B79AD
2009-03-03 19:02 1103 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_37259496CDCF68A4CB7B945B403DBFE0
2009-03-03 19:02 108 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_0B79C053C7D38EE4AB9A00CB3B5D2472.dll
2009-03-03 19:02 1071 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_382BBE58FA5635C4E9EBC7A03272267F.dll
2009-03-03 19:02 10 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_EB96792CFDEBE9CD769AE5A7FE0F93FC.dll
2009-03-03 19:02 10 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_566F07119532934EB55C39B27824E31F.dll
2009-03-03 19:02 10 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_4921E8E515979AD6011F8C777831643F.dll
2009-03-03 19:02 10 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\icn_18E47D93DED5EE7C8870198A082021AF.dll
2004-08-03 23:56 708096 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\_enviewlist.dll
2004-08-03 23:56 616960 --a------ c:\documents and settings\All Users\Application Data\SecTaskMan\_entreelist.dll
((((((((((((((((((((((((((((( SnapShot@2009-03-05_20.00.57.40 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-03-05 18:41:52 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-03-06 11:02:38 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-03-05 18:41:52 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-03-06 11:02:38 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-03-05 18:41:52 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-03-06 11:02:38 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-03-06 11:06:31 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_57c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2008-10-08 173368]
[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-09-29 17:24 325000 --a------ c:\program files\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
2008-09-02 15:05 398776 --a------ c:\program files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2008-10-08 12:22 1172792 --a------ c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-10-08 1172792]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-29 325000]
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-10-08 1172792]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-29 325000]
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 153136]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-08 68856]
"msnmsgr"="~c:\program files\MSN Messenger\msnmsgr.exe" [BU]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 153136]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"Nitro PDF Printer Monitor"="c:\program files\Nitro PDF\Professional\NitroPDFPrinterMonitor.exe" [2008-02-01 210208]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2008-12-02 111928]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-12-22 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-05 136600]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-16 206088]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-27 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2007-08-03 c:\windows\SkyTel.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\WS\Start Menu\Programs\Startup\
Picture Motion Browser Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2009-01-14 376832]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Counter-Strike 1.6\\hl.exe"=
"c:\\Program Files\\Counter-Strike 1.6\\hlds.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592]
R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service;c:\program files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S3 bepldr;BCL easyPDF SDK 5 Loader;c:\program files\Common Files\BCL Technologies\NitroPDF5\bepldr.exe [2007-11-15 151552]
.
Contents of the 'Scheduled Tasks' folder
2009-02-13 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe []
2009-03-06 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2006-09-27 17:39]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ba/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mStart Page = about:blank
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: I&zvoz u Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {54EF60C2-EC04-4016-B055-23A00F39E946} = 212.39.98.161,212.39.98.162
FF - ProfilePath - c:\documents and settings\WS\Application Data\Mozilla\Firefox\Profiles\dyfo66ot.default\
---- FIREFOX POLICIES ----
pref(dom.disable_open_during_load, true);.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2009-03-06 12:14:23
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1004336348-1454471165-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1000)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-03-06 12:16:40
ComboFix-quarantined-files.txt 2009-03-06 11:16:38
ComboFix2.txt 2009-03-06 00:38:14
ComboFix3.txt 2009-03-05 19:01:36
Pre-Run: 71.925.784.576 bytes free
Post-Run: 71,911,718,912 bytes free
296 --- E O F --- 2009-03-06 02:00:36
|
