Login  Malware Removal & HijackThis Logs |
| |
| |
| | Thread Tools |
16-May-2008, 02:34 PM
#21 | ||||||
| Hello, Ok, couple of things, I made sure the teatimer was unchecked and it was and then ran combo fix by dragging the script on to the executable. I did notice when combo fix was running I did see in the bottom right corner that a change was denied because of a user blacklist or something (it just flashed). Do I need to do something else to turn off spybot? Also, right before the combo fix log came up I saw the following message in the box: The system cannot find the file fdsv_cb. I believe that was the message, I couldn't find a pen right away.  Anyway, here is the latest combo fix log. The HijackThis log will be in the next reply... ---------------------------------------------- ComboFix 08-05-09.1 - erika 2008-05-16 12:29:43.4 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.2268 [GMT -5:00] Running from: C:\Users\erika\Desktop\ComboFix.exe Command switches used :: C:\Users\erika\Desktop\CFScript.txt * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2008-04-16 to 2008-05-16 ))))))))))))))))))))))))))))))) . 2008-05-15 20:02 . 2008-05-15 20:02 <DIR> d-------- C:\Users\erika\AppData\Roaming\PeerNetworking 2008-05-08 21:59 . 2008-05-08 21:59 <DIR> d-------- C:\Users\erika\AppData\Roaming\Malwarebytes 2008-05-08 21:59 . 2008-05-08 21:59 <DIR> d-------- C:\Users\All Users\Malwarebytes 2008-05-08 21:59 . 2008-05-08 21:59 <DIR> d-------- C:\ProgramData\Malwarebytes 2008-05-08 21:59 . 2008-05-08 23:03 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-05-08 21:59 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\System32\drivers\mbamcatchme.sys 2008-05-08 21:59 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\System32\drivers\mbam.sys 2008-05-05 21:03 . 2008-05-07 12:29 287,899,900 --a------ C:\WINDOWS\MEMORY.DMP 2008-05-03 12:23 . 2008-05-03 12:23 <DIR> d-------- C:\Users\erika\AppData\Roaming\Roxio 2008-04-22 21:57 . 2008-04-22 21:57 <DIR> d-------- C:\Autoruns . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-16 17:31 25,903,392 --sha-w C:\Windows\system32\drivers\fidbox.dat 2008-05-16 01:00 --------- d-----w C:\ProgramData\Kaspersky Lab 2008-05-15 17:58 340,736 --sha-w C:\Windows\system32\drivers\fidbox.idx 2008-05-03 17:23 --------- d-----w C:\ProgramData\Sonic 2008-04-23 01:49 96,645 ----a-w C:\Windows\system32\drivers\klin.dat 2008-04-23 01:49 87,941 ----a-w C:\Windows\system32\drivers\klick.dat 2008-04-21 19:58 --------- d---a-w C:\ProgramData\TEMP 2008-04-14 20:23 --------- d-----w C:\ProgramData\Fugazo 2008-04-14 04:40 --------- d-----w C:\ProgramData\SpinTop Games 2008-04-14 03:29 --------- d-----w C:\Users\erika\AppData\Roaming\Apple Computer 2008-04-14 02:02 --------- d-----w C:\ProgramData\Spybot - Search & Destroy 2008-04-14 01:23 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-04-14 01:01 --------- d-----w C:\ProgramData\Lavasoft 2008-04-14 01:00 --------- d-----w C:\Program Files\Lavasoft 2008-04-14 00:50 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-04-13 04:12 --------- d-----w C:\Users\erika\AppData\Roaming\PlayFirst 2008-04-13 04:12 --------- d-----w C:\ProgramData\PlayFirst 2008-04-13 00:02 174 --sha-w C:\Program Files\desktop.ini 2008-04-12 23:59 --------- d-----w C:\Program Files\Windows Mail 2008-04-12 23:59 --------- d-----w C:\Program Files\Windows Calendar 2008-04-12 23:58 --------- d-----w C:\Program Files\Windows Sidebar 2008-04-12 23:57 --------- d-----w C:\ProgramData\Microsoft Help 2008-04-12 23:55 194,560 ----a-w C:\Windows\System32\WebClnt.dll 2008-04-12 23:55 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys 2008-04-12 23:53 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL 2008-04-12 23:53 7,680 ----a-w C:\Windows\System32\spwmp.dll 2008-04-12 23:53 41,984 ----a-w C:\Windows\system32\drivers\monitor.sys 2008-04-12 23:53 4,096 ----a-w C:\Windows\System32\dxmasf.dll 2008-04-12 23:53 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll 2008-04-12 23:53 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys 2008-04-12 23:53 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-04-12 23:52 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys 2008-04-12 23:52 3,505,720 ----a-w C:\Windows\System32\ntkrnlpa.exe 2008-04-12 23:52 3,471,928 ----a-w C:\Windows\System32\ntoskrnl.exe 2008-04-12 23:52 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys 2008-04-12 23:52 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys 2008-04-12 23:52 17,464 ----a-w C:\Windows\system32\drivers\intelide.sys 2008-04-12 23:52 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys 2008-04-12 23:52 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys 2008-04-12 23:51 8,704 ----a-w C:\Windows\System32\hcrstco.dll 2008-04-12 23:51 8,704 ----a-w C:\Windows\System32\hccoin.dll 2008-04-12 23:51 73,216 ----a-w C:\Windows\system32\drivers\usbccgp.sys 2008-04-12 23:51 5,888 ----a-w C:\Windows\system32\drivers\usbd.sys 2008-04-12 23:51 38,400 ----a-w C:\Windows\system32\drivers\usbehci.sys 2008-04-12 23:51 23,040 ----a-w C:\Windows\system32\drivers\usbuhci.sys 2008-04-12 23:51 224,768 ----a-w C:\Windows\system32\drivers\usbport.sys 2008-04-12 23:51 2,048 ----a-w C:\Windows\System32\msxml3r.dll 2008-04-12 23:51 193,536 ----a-w C:\Windows\system32\drivers\usbhub.sys 2008-04-12 23:51 1,191,936 ----a-w C:\Windows\System32\msxml3.dll 2008-04-12 23:50 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys 2008-04-12 23:50 24,064 ----a-w C:\Windows\System32\netcfg.exe 2008-04-12 23:50 22,016 ----a-w C:\Windows\System32\netiougc.exe 2008-04-12 23:50 216,632 ----a-w C:\Windows\system32\drivers\netio.sys 2008-04-12 23:50 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll 2008-04-12 23:50 1,327,104 ----a-w C:\Windows\System32\quartz.dll 2008-04-12 23:48 2,028,544 ----a-w C:\Windows\System32\win32k.sys 2008-04-12 23:47 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL 2008-04-12 23:47 296,448 ----a-w C:\Windows\System32\gdi32.dll 2008-04-12 23:47 223,232 ----a-w C:\Windows\System32\WMASF.DLL 2008-04-12 23:47 2,048 ----a-w C:\Windows\System32\msxml6r.dll 2008-04-12 23:47 2,048 ----a-w C:\Windows\System32\asferror.dll 2008-04-12 23:47 1,335,296 ----a-w C:\Windows\System32\msxml6.dll 2008-04-12 23:45 84,480 ----a-w C:\Windows\System32\INETRES.dll 2008-04-12 23:45 737,792 ----a-w C:\Windows\System32\inetcomm.dll 2008-04-12 23:45 11,776 ----a-w C:\Windows\System32\sbunattend.exe 2008-04-12 23:43 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys 2008-04-12 23:43 84,480 ----a-w C:\Windows\System32\dnsrslvr.dll 2008-04-12 23:43 788,992 ----a-w C:\Windows\System32\rpcrt4.dll 2008-04-12 23:43 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys 2008-04-12 23:43 24,576 ----a-w C:\Windows\System32\dnscacheugc.exe 2008-04-12 23:43 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys 2008-04-12 23:43 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys 2008-04-12 23:42 826,368 ----a-w C:\Windows\System32\wininet.dll 2008-04-12 23:42 56,320 ----a-w C:\Windows\System32\iesetup.dll 2008-04-12 23:42 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll 2008-04-12 23:42 26,624 ----a-w C:\Windows\System32\ieUnatt.exe 2008-04-12 23:42 --------- d-----w C:\Program Files\MSXML 4.0 2008-04-12 23:41 2,048 ----a-w C:\Windows\System32\tzres.dll 2008-04-12 23:40 750,080 ----a-w C:\Windows\System32\qmgr.dll 2008-04-12 23:40 1,244,672 ----a-w C:\Windows\System32\mcmde.dll 2008-04-12 15:37 --------- d-----w C:\Program Files\Kaspersky Lab 2008-04-12 14:49 80,896 ----a-w C:\Windows\System32\wudriver.dll 2008-04-12 14:49 549,720 ----a-w C:\Windows\System32\wuapi.dll 2008-04-12 14:49 53,080 ----a-w C:\Windows\System32\wuauclt.exe 2008-04-12 14:49 43,352 ----a-w C:\Windows\System32\wups2.dll 2008-04-12 14:49 33,624 ----a-w C:\Windows\System32\wups.dll 2008-04-12 14:49 31,232 ----a-w C:\Windows\System32\wuapp.exe 2008-04-12 14:49 163,000 ----a-w C:\Windows\System32\wuwebv.dll 2008-04-12 14:49 1,712,984 ----a-w C:\Windows\System32\wuaueng.dll 2008-04-12 14:49 1,524,224 ----a-w C:\Windows\System32\wucltux.dll 2008-04-06 21:56 --------- d-----w C:\Users\erika\AppData\Roaming\Mysteryville2 2008-04-06 19:43 --------- d-----w C:\Program Files\QuickTime 2008-04-06 19:43 --------- d-----w C:\Program Files\iTunes 2008-04-06 19:43 --------- d-----w C:\Program Files\iPod 2008-04-02 15:19 --------- d-----w C:\ProgramData\Symantec 2008-04-02 04:21 --------- d-----w C:\ProgramData\Interama 2008-03-31 04:35 --------- d-----w C:\Users\erika\AppData\Roaming\BloodTies 2008-03-29 04:41 --------- d-----w C:\Users\erika\AppData\Roaming\Yatec Games 2008-03-28 04:05 --------- d-----w C:\Users\erika\AppData\Roaming\Ludia 2008-03-28 04:05 --------- d-----w C:\ProgramData\Ludia . ------- Sigcheck ------- . ((((((((((((((((((((((((((((( snapshot_2008-05-15_20.10.22.94 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-16 00:59:59 67,584 --s-a-w C:\Windows\bootstat.dat + 2008-05-16 17:27:28 67,584 --s-a-w C:\Windows\bootstat.dat - 2008-05-16 01:07:59 6,123,520 ----a-w C:\Windows\erdnt\Hiv-backup\SCHEMA.DAT + 2008-05-16 17:29:35 6,123,520 ----a-w C:\Windows\erdnt\Hiv-backup\SCHEMA.DAT - 2008-05-16 01:00:02 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\usr class.dat + 2008-05-16 17:27:30 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\usr class.dat - 2008-05-16 01:07:40 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\u srclass.dat + 2008-05-16 17:29:26 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\u srclass.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}] 2007-12-17 11:12 56360 --a------ C:\Program Files\Windows Live\Family Safety\fssbho.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-04-12 18:45 1232896] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-03-07 22:19 171448] "cmds"="C:\Users\erika\AppData\Local\Temp\ddcAspop.dll" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-11-13 10:53 1006264] "hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 10:01 65536] "KBD"="C:\HP\KBD\KbdStub.EXE" [2006-12-08 11:16 65536] "OsdMaestro"="C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 06:59 118784] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-06-14 23:31 178968] "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-08-09 05:30 86016] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-08-09 05:30 8466432] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-08-09 05:30 81920] "RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 06:06 4669440 C:\WINDOWS\RtHDVCpl.exe] "CCUTRAYICON"="FactoryMode" [] "HP Health Check Scheduler"="c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-05-24 16:13 71176] "SunJavaUpdateReg"="C:\Windows\system32\jureg.exe" [2007-04-07 05:56 54936] "HP Software Update"="c:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 02:11 49152] "Airlink101 WLAN Monitor"="C:\Program Files\Airlink101\WLAN Monitor\WLANmon.exe" [2006-06-30 19:55 954368] "ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2006-06-01 17:59 49152] "fssui"="C:\Program Files\Windows Live\Family Safety\fssui.exe" [2007-12-17 11:12 243240] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2008-02-08 18:36 227856] "MSConfig"="C:\Windows\system32\msconfig.exe" [2006-11-02 04:45 222208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Launcher"="%WINDIR%\SMINST\launcher.exe" [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snapfish Media Detector.lnk] path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish Media Detector.lnk backup=C:\Windows\pss\Snapfish Media Detector.lnk.CommonStartup backupExtension=.CommonStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2008-03-07 22:19 171448 C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{7A3B5625-78D9-4922-ABF2-30F21E46EBDC}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM "{F63876C7-30A6-4E61-9BB2-B53E7362BAC7}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM "{D9699CBD-B153-4691-AC9A-406F65088F8A}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server "{E09CE15B-5F01-47D5-8BE7-FBCBB365D870}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server "{BCAECF92-ADD0-41AA-99BE-8F5770E8070B}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service "{6C8D929A-4B68-49EA-81A0-7170286E1F1B}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service "{40A0175B-A9DC-403A-AE5D-E2EDDECFA1AC}"= TCP:9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery "{D1D8A6F1-B4A8-4038-AA50-A94B45ACF46B}"= TCP:1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery "{C62A9A0D-93EF-4694-9B6B-653C888A0C1D}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl "{E11CD62B-1268-49A0-8EB6-3C269172D1D2}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl "{91C21F08-BD4D-4C25-97DB-AC69D95B488E}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl "{60C45900-ECA0-4BF4-AF7C-E2DE5A4BA0EA}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl "{E57CF611-7A89-4510-B9C2-57B390CBA7EC}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl "{96BDE7AA-D7FC-45C7-B444-F6E393B08743}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl "{F1C0B9AA-5EA2-4D0F-9B91-E83DEBAD30E8}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{E207882F-CD91-4A41-9702-20A7728DAAB0}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{840A055E-CEBF-463E-BDD1-EA300682BC85}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{C2991F59-4E74-4DCB-BB13-3025C3EE8DFE}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{A0ABCBDA-5035-48A1-AE8E-35FF9F1887DE}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "TCP Query User{A131C91F-981B-46C2-9510-AE157BB10166}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{74865007-5F4C-4DAA-BC26-0217513F1F8F}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{10D4FB18-D112-45E5-8DB2-C6FF3F059308}C:\\program files\\rhapsody\\rhapsody.exe"= UDP:C:\program files\rhapsody\rhapsody.exe:RealNetworks Rhapsody "UDP Query User{5E5344FC-3B57-4110-8107-CCC80DB6D799}C:\\program files\\rhapsody\\rhapsody.exe"= TCP:C:\program files\rhapsody\rhapsody.exe:RealNetworks Rhapsody "{B9AC8E60-D29D-45A8-B32D-7232744F1F1A}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes "{308ED02F-1234-4DD4-8645-A2107BE5FA9B}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes "TCP Query User{E0F427E9-ECB3-4178-94BF-7670477172DD}C:\\kav\\kav7\\setup.exe"= UDP:C:\kav\kav7\setup.exe:Kaspersky Anti-Virus 7.0 Setup "UDP Query User{ED0379E4-2470-4A18-A43C-5DA53F62CCC6}C:\\kav\\kav7\\setup.exe"= TCP:C:\kav\kav7\setup.exe:Kaspersky Anti-Virus 7.0 Setup [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\S tatic\System] "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic| [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\Auth orizedApplications\List] "C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\system32\DRIVERS\klim6.sys [2007-10-16 11:05] R2 DQLWinService;DQLWinService;"C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe" [2006-09-03 13:32] R2 fssfltr;FssFltr;C:\Windows\system32\DRIVERS\fssfltr.sys [2007-10-17 13:53] R2 fsssvc;Windows Live OneCare Family Safety;"C:\Program Files\Windows Live\Family Safety\fsssvc.exe" [2007-12-17 11:13] R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-01-28 11:43] R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2006-11-28 11:44] R3 AL101;Airlink101 802.11g PCI Driver;C:\Windows\system32\DRIVERS\AL101.sys [2006-07-04 16:28] S2 IntelDHSvcConf;Intel DH Service;"C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe" [2006-05-10 12:13] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\{b28142bf-eb54-11dc-bb84-806e6f6e6963}] \shell\AutoRun\command - E:\Autorun.exe \shell\install\command - E:\Install.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\{ed0d312c-0962-11dd-b065-001d606465ef}] \shell\AutoRun\command - L:\CAEdgemobile.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-16 12:31:24 Windows 6.0.6000 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-16 12:32:19 ComboFix-quarantined-files.txt 2008-05-16 17:32:15 ComboFix2.txt 2008-05-16 01:10:52 ComboFix3.txt 2008-05-15 17:56:11 Pre-Run: 369,043,468,288 bytes free Post-Run: 370,579,173,376 bytes free 252 --- E O F --- 2008-05-14 07:15:32 |
