Login 
 Search | |
| |
29-Jun-2009, 08:31 AM
#31 | |||||
| |
| |
30-Jun-2009, 10:23 PM
#39 | |||||
| i ran the combofix both with windows defender enabled and disabled and it still comes up the same....Her is the log with it disabled.....and it shows it as enabled.....very strange.. ComboFix 09-06-26.02 - Jason Nordeman 06/27/2009 21:16.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2046.1287 [GMT -4:00] Running from: E:\ComboFix.exe SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . ((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-06-28 ))))))))))))))))))))))))))))))) . 2009-06-28 01:23 . 2009-06-28 01:23 -------- d-----w- c:\users\Jason Nordeman\AppData\Local\temp 2009-06-27 14:48 . 2009-06-27 14:48 -------- d-----w- c:\users\Jason Nordeman\AppData\Local\data 2009-06-27 14:39 . 2009-06-27 14:39 -------- d-----w- c:\users\Jason Nordeman\AppData\Local\quicktime 2009-06-27 14:39 . 2009-06-27 14:39 -------- d-----w- c:\users\Jason Nordeman\AppData\Local\META-INF 2009-06-27 14:39 . 2009-06-27 14:39 -------- d-----w- c:\users\Jason Nordeman\AppData\Local\com 2009-06-27 14:39 . 2009-06-27 14:39 -------- d-----w- c:\users\Jason Nordeman\AppData\Local\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} 2009-06-27 14:39 . 2009-06-27 14:39 -------- d-----w- c:\users\Jason Nordeman\AppData\Local\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} 2009-06-26 02:11 . 2009-06-26 02:42 -------- d-s---w- C:\Combo-Fix 2009-06-25 12:48 . 2009-06-25 11:41 2052888 ----a-w- c:\programdata\avg8\update\backup\avgcorex.dll 2009-06-25 12:40 . 2009-06-27 17:00 -------- d--h--w- C:\$AVG8.VAULT$ 2009-06-25 11:43 . 2009-06-14 20:07 1004800 ----a-w- c:\programdata\AVG Security Toolbar\IEToolbar.dll 2009-06-25 11:41 . 2009-06-25 11:41 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-06-25 11:41 . 2009-06-25 11:41 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2009-06-25 11:41 . 2009-06-25 11:41 327688 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-06-25 11:41 . 2009-06-25 11:41 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-06-25 11:41 . 2009-06-25 11:43 -------- d-----w- c:\windows\system32\drivers\Avg 2009-06-25 11:41 . 2009-06-25 11:43 -------- d-----w- c:\programdata\AVG Security Toolbar 2009-06-24 21:44 . 2009-06-24 21:52 -------- d-----w- c:\windows\BDOSCAN8 2009-06-22 10:46 . 2009-06-22 10:46 93 ----a-w- c:\windows\system32\SKYNET.dat 2009-06-21 18:01 . 2009-06-21 18:01 -------- d-----w- c:\users\Jason Nordeman\AppData\Roaming\Malwarebytes 2009-06-21 18:00 . 2009-06-21 18:00 -------- d-----w- c:\programdata\Malwarebytes 2009-06-13 16:39 . 2009-04-30 12:37 428544 ----a-w- c:\windows\system32\EncDec.dll 2009-06-13 16:39 . 2009-04-30 12:37 293376 ----a-w- c:\windows\system32\psisdecd.dll 2009-06-12 20:34 . 2009-04-21 11:55 2033152 ----a-w- c:\windows\system32\win32k.sys 2009-06-12 20:34 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll 2009-06-09 22:31 . 2009-06-09 22:31 758088 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\Spotlight Resources.dll 2009-05-30 18:11 . 2009-05-30 18:27 -------- d-----w- c:\users\Jason Nordeman\AppData\Roaming\W Photo Studio 2009-05-30 18:09 . 2009-05-30 18:09 -------- d-----w- c:\programdata\Walgreens 2009-05-30 18:09 . 2009-05-30 18:09 -------- d-----w- c:\users\Jason Nordeman\AppData\Roaming\Walgreens 2009-05-30 18:09 . 2009-05-30 18:09 -------- d-----w- c:\program files\Common Files\HP 2009-05-30 18:09 . 2009-05-30 18:09 -------- d-----w- c:\program files\Walgreens 2009-05-30 18:00 . 2009-05-30 18:27 -------- d-----w- c:\users\Jason Nordeman\AppData\Roaming\W Photo Studio Viewer . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-06-28 01:12 . 2008-11-09 18:05 -------- d-----w- c:\users\Jason Nordeman\AppData\Roaming\SUPERAntiSpyware.com 2009-06-28 01:12 . 2008-11-09 18:05 -------- d-----w- c:\program files\SUPERAntiSpyware 2009-06-27 11:26 . 2009-03-16 18:29 -------- d-----w- c:\programdata\avg8 2009-06-25 23:18 . 2007-05-09 13:46 -------- d-----w- c:\program files\Corel 2009-06-25 23:17 . 2007-05-09 13:54 -------- d-----w- c:\program files\Google 2009-06-24 20:37 . 2009-04-10 00:28 -------- d-----w- c:\program files\DVDVideoSoft 2009-06-22 10:47 . 2007-05-14 22:59 13448 ----a-w- c:\users\Jason Nordeman\AppData\Roaming\nvModes.dat 2009-06-21 17:49 . 2007-06-26 12:47 -------- d-----w- c:\programdata\Spybot - Search & Destroy 2009-06-19 16:03 . 2007-06-05 16:37 -------- d-----w- c:\users\Jason Nordeman\AppData\Roaming\LimeWire 2009-06-15 13:46 . 2009-04-19 20:39 -------- d-----w- c:\program files\Dl_cats 2009-06-10 13:36 . 2009-04-20 05:29 -------- d-----w- c:\users\Jason Nordeman\AppData\Roaming\DellFaxCtr 2009-05-27 20:05 . 2009-05-27 19:50 -------- d-----w- c:\program files\Coupons 2009-05-16 16:06 . 2009-05-16 16:06 416128 ----a-w- c:\programdata\Microsoft\eHome\Packages\NetTV\Browse\NetTVResources.dll 2009-05-14 07:00 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2009-05-03 23:00 . 2007-06-05 16:37 -------- d-----w- c:\program files\LimeWire 2009-05-01 21:29 . 2007-05-15 00:03 -------- d-----w- c:\programdata\AOL 2009-04-24 16:05 . 2009-06-12 20:33 827904 ----a-w- c:\windows\system32\wininet.dll 2009-04-24 16:02 . 2009-06-12 20:33 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-04-24 13:44 . 2009-06-12 20:33 26624 ----a-w- c:\windows\system32\ieUnatt.exe 2009-04-23 12:43 . 2009-06-12 20:33 784896 ----a-w- c:\windows\system32\rpcrt4.dll 2007-05-09 21:21 . 2007-05-09 21:20 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT . ((((((((((((((((((((((((((((( SnapShot@2009-06-26_02.38.18 ))))))))))))))))))))))))))))))))))))))))) . + 2007-05-09 14:07 . 2009-06-27 11:28 45488 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2006-11-02 13:05 . 2009-06-28 00:58 63858 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2007-05-14 22:25 . 2009-06-28 00:58 14184 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2996572545-135866921-4033492168-1000_UserData.bin - 2009-06-26 02:26 . 2009-06-26 02:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2009-06-27 11:26 . 2009-06-28 00:56 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2009-06-27 11:26 . 2009-06-28 00:56 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-06-26 02:26 . 2009-06-26 02:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2007-05-14 22:59 . 2009-06-27 11:16 238614 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2006-11-02 10:33 . 2009-06-28 01:03 595684 c:\windows\System32\perfh009.dat - 2006-11-02 10:33 . 2009-06-26 02:34 595684 c:\windows\System32\perfh009.dat - 2006-11-02 10:33 . 2009-06-26 02:34 101350 c:\windows\System32\perfc009.dat + 2006-11-02 10:33 . 2009-06-28 01:03 101350 c:\windows\System32\perfc009.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}] 2009-06-14 20:07 1004800 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\syste m] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\System32\avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDef end] @="Service" [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk backup=c:\windows\pss\Digital Line Detect.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickSet.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickSet.lnk backup=c:\windows\pss\QuickSet.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SCClient.exe.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\SCClient.exe.lnk backup=c:\windows\pss\SCClient.exe.lnk.CommonStartup backupExtension=.CommonStartup [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2996572545-135866921-4033492168-1000] "EnableNotificationsRef"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{30D18C48-2E87-4AB5-B5F5-5C5C90D409BE}"= UDP:c:\program files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent "{33ECB0B3-0BA8-4AEF-A847-3DE8AB30765A}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader "{752A2A26-7848-4B6F-95F5-99C961DD44D0}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader "{44AC46A5-5D40-4064-96EE-72C1852EB6F8}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{40AA8754-CC61-4C37-92CC-18E467D9FF9E}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{CAEDFBF3-8AC1-4501-9187-7B6C3AE33A99}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{2B0C8748-C298-4593-9A2C-F711CE3BF54B}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{565BCD25-E083-4F79-95BE-CA8B17076CBD}"= UDP:c:\users\Jason Nordeman\Desktop\Shared\LimeWire\LimeWire.exe:LimeWire "{C63E095A-D1A0-48BC-AB5A-453C57DB18E9}"= TCP:c:\users\Jason Nordeman\Desktop\Shared\LimeWire\LimeWire.exe:LimeWire "{1BEF7C0B-FA0A-4A4A-8C3F-4D27EA4F706D}"= UDP:c:\users\Jason Nordeman\Desktop\Office, pp, excel\Shared\LimeWire\LimeWire.exe:LimeWire "{ED31C1C4-A6AD-4BDD-95F3-FD502A945883}"= TCP:c:\users\Jason Nordeman\Desktop\Office, pp, excel\Shared\LimeWire\LimeWire.exe:LimeWire "{E0D5481E-022F-4EF1-8E73-ECBC0F06C920}"= UDP:c:\users\Jason Nordeman\Desktop\Shared\LimeWire\LimeWire.exe:LimeWire "{981B494F-F1CE-40FB-B17C-0AFD5C540E0E}"= TCP:c:\users\Jason Nordeman\Desktop\Shared\LimeWire\LimeWire.exe:LimeWire "TCP Query User{C4596475-1235-497F-A66C-B4D67FCAD7A9}c:\\program files\\internet explorer\\iexplore.exe"= Disabled:UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{AF475501-7225-430C-988D-2A6E013A29B5}c:\\program files\\internet explorer\\iexplore.exe"= Disabled:TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{1ADC034B-24D0-4A4E-8F68-68E50C690B8A}c:\\program files\\itunes\\itunes.exe"= UDP:c:\program files\itunes\itunes.exe:iTunes "UDP Query User{D4FF6448-E444-46D6-A271-BA1D2AFEA691}c:\\program files\\itunes\\itunes.exe"= TCP:c:\program files\itunes\itunes.exe:iTunes "TCP Query User{432D73F0-7642-43D9-87DC-9F68B74F2CE0}c:\\users\\jason nordeman\\desktop\\new folder (2)\\soulseek\\slsk.exe"= UDP:c:\users\jason nordeman\desktop\new folder (2)\soulseek\slsk.exe:slsk.exe "UDP Query User{FACFF2AA-A4F9-458E-95D1-F6CD1EE9F7B5}c:\\users\\jason nordeman\\desktop\\new folder (2)\\soulseek\\slsk.exe"= TCP:c:\users\jason nordeman\desktop\new folder (2)\soulseek\slsk.exe:slsk.exe "TCP Query User{322DAA30-8DA3-4C37-9C85-B5CEF9F40FE8}c:\\users\\jason nordeman\\desktop\\new folder\\soulseek\\slsk.exe"= UDP:c:\users\jason nordeman\desktop\new folder\soulseek\slsk.exe:slsk.exe "UDP Query User{9F5ED81A-1F16-4F64-AB61-F41C9897B5BD}c:\\users\\jason nordeman\\desktop\\new folder\\soulseek\\slsk.exe"= TCP:c:\users\jason nordeman\desktop\new folder\soulseek\slsk.exe:slsk.exe "TCP Query User{1751EDD1-3958-4FD3-95BD-A6B80B23B128}c:\\users\\jason nordeman\\desktop\\soulseek\\slsk.exe"= UDP:c:\users\jason nordeman\desktop\soulseek\slsk.exe:slsk.exe "UDP Query User{6A3D6779-DA09-4D53-8FC9-D81790679962}c:\\users\\jason nordeman\\desktop\\soulseek\\slsk.exe"= TCP:c:\users\jason nordeman\desktop\soulseek\slsk.exe:slsk.exe "{5612308F-E23E-41A3-8E8F-66EE85702116}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{6C62D755-6B0D-433F-BEE3-477E65302824}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{93EA2948-2AC6-4714-B668-CD8E389D7EB7}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{7FE49F12-FD2C-44D3-B448-A0332C9DCC27}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes "{A31D874D-C774-4C50-9B37-EFEACEDB7126}"= UDP:c:\windows\System32\dlcxcoms.exe:Lexmark Communications System "{53CACE5E-F6F6-43A2-9F4A-8DCE351D4777}"= TCP:c:\windows\System32\dlcxcoms.exe:Lexmark Communications System "{EBADB57F-E90E-40F5-84BD-6C96A9614010}"= UDP:c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe  evice Monitor"{F598B523-83A8-4254-896D-63C7555B199C}"= TCP:c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe evice Monitor"{4D21C11A-78EA-451E-9EE6-F0972D57AB40}"= UDP:c:\program files\Dell Photo AIO Printer 926\dlcxaiox.exe:All In One Center "{EB5045ED-A6F7-4C5F-BC2E-141F40265387}"= TCP:c:\program files\Dell Photo AIO Printer 926\dlcxaiox.exe:All In One Center "{04133352-B104-419F-9DAC-EA90F86045E1}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe "{163E3D9F-747E-4609-862C-86EE434602CF}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [6/25/2009 7:41 AM 327688] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [6/25/2009 7:41 AM 108552] R2 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe -service --> c:\windows\system32\dlcxcoms.exe -service [?] R2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [1/15/2008 10:28 AM 204800] R2 scManager;SafeConnect Network manager ;c:\program files\Impulse\scManager.sys servicestart --> c:\program files\Impulse\scManager.sys servicestart [?] R3 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [6/25/2009 7:41 AM 298776] . . ------- Supplementary Scan ------- . uStart Page = https://webmail.wcupa.edu/exchweb/bi...ange/&reason=0 uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-06-27 21:23 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... c:\users\JASONN~1\AppData\Local\Temp\catchme.dll 53248 bytes executable scan completed successfully hidden files: 1 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2009-06-28 21:27 ComboFix-quarantined-files.txt 2009-06-28 01:27 ComboFix2.txt 2009-06-26 02:42 Pre-Run: 12,120,854,528 bytes free Post-Run: 11,720,769,536 bytes free 189 --- E O F --- 2009-06-22 22:50 |
01-Jul-2009, 08:41 AM
#40 | |||||
| once again I went into services.msc and made sure that windows defender was set to disabled and ran a log, but I don't think it is any different....here it is though: ComboFix 09-06-29.07 - Jason Nordeman 07/01/2009 7:25.12 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2046.1150 [GMT -4:00] Running from: c:\users\Jason Nordeman\Desktop\combo-fix.exe.exe Command switches used :: c:\users\Jason Nordeman\Desktop\CFScript.txt SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . ((((((((((((((((((((((((( Files Created from 2009-06-01 to 2009-07-01 ))))))))))))))))))))))))))))))) . 2009-07-01 11:30 . 2009-07-01 11:30 -------- d-----w- c:\users\Jason Nordeman\AppData\Local\temp 2009-06-30 20:11 . 2009-07-01 00:02 -------- d-----w- C:\ComboFix 2009-06-28 22:44 . 2009-06-28 22:44 746744 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\Spotlight Resources.dll 2009-06-27 14:48 . 2009-06-27 14:48 -------- d-----w- c:\users\Jason Nordeman\AppData\Local\data 2009-06-27 14:39 . 2009-06-27 14:39 -------- d-----w- c:\users\Jason Nordeman\AppData\Local\quicktime 2009-06-27 14:39 . 2009-06-27 14:39 -------- d-----w- c:\users\Jason Nordeman\AppData\Local\META-INF 2009-06-27 14:39 . 2009-06-27 14:39 -------- d-----w- c:\users\Jason Nordeman\AppData\Local\com 2009-06-27 14:39 . 2009-06-27 14:39 -------- d-----w- c:\users\Jason Nordeman\AppData\Local\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} 2009-06-27 14:39 . 2009-06-27 14:39 -------- d-----w- c:\users\Jason Nordeman\AppData\Local\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} 2009-06-25 12:48 . 2009-06-25 11:41 2052888 ----a-w- c:\programdata\avg8\update\backup\avgcorex.dll 2009-06-25 12:40 . 2009-06-30 22:47 -------- d--h--w- C:\$AVG8.VAULT$ 2009-06-25 11:41 . 2009-06-25 11:41 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-06-25 11:41 . 2009-06-25 11:41 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2009-06-25 11:41 . 2009-06-25 11:41 327688 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-06-25 11:41 . 2009-06-25 11:41 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-06-25 11:41 . 2009-06-30 23:54 -------- d-----w- c:\windows\system32\drivers\Avg 2009-06-24 21:44 . 2009-06-24 21:52 -------- d-----w- c:\windows\BDOSCAN8 2009-06-22 10:46 . 2009-06-22 10:46 93 ----a-w- c:\windows\system32\SKYNET.dat 2009-06-21 18:01 . 2009-06-21 18:01 -------- d-----w- c:\users\Jason Nordeman\AppData\Roaming\Malwarebytes 2009-06-21 18:00 . 2009-06-21 18:00 -------- d-----w- c:\programdata\Malwarebytes 2009-06-13 16:39 . 2009-04-30 12:37 428544 ----a-w- c:\windows\system32\EncDec.dll 2009-06-13 16:39 . 2009-04-30 12:37 293376 ----a-w- c:\windows\system32\psisdecd.dll 2009-06-12 20:34 . 2009-04-21 11:55 2033152 ----a-w- c:\windows\system32\win32k.sys 2009-06-12 20:34 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-06-30 21:47 . 2009-03-16 18:29 -------- d-----w- c:\programdata\avg8 2009-06-28 01:12 . 2008-11-09 18:05 -------- d-----w- c:\users\Jason Nordeman\AppData\Roaming\SUPERAntiSpyware.com 2009-06-28 01:12 . 2008-11-09 18:05 -------- d-----w- c:\program files\SUPERAntiSpyware 2009-06-25 23:18 . 2007-05-09 13:46 -------- d-----w- c:\program files\Corel 2009-06-25 23:17 . 2007-05-09 13:54 -------- d-----w- c:\program files\Google 2009-06-24 20:37 . 2009-04-10 00:28 -------- d-----w- c:\program files\DVDVideoSoft 2009-06-22 10:47 . 2007-05-14 22:59 13448 ----a-w- c:\users\Jason Nordeman\AppData\Roaming\nvModes.dat 2009-06-21 17:49 . 2007-06-26 12:47 -------- d-----w- c:\programdata\Spybot - Search & Destroy 2009-06-19 16:03 . 2007-06-05 16:37 -------- d-----w- c:\users\Jason Nordeman\AppData\Roaming\LimeWire 2009-06-15 13:46 . 2009-04-19 20:39 -------- d-----w- c:\program files\Dl_cats 2009-06-10 13:36 . 2009-04-20 05:29 -------- d-----w- c:\users\Jason Nordeman\AppData\Roaming\DellFaxCtr 2009-05-30 18:27 . 2009-05-30 18:11 -------- d-----w- c:\users\Jason Nordeman\AppData\Roaming\W Photo Studio 2009-05-30 18:27 . 2009-05-30 18:00 -------- d-----w- c:\users\Jason Nordeman\AppData\Roaming\W Photo Studio Viewer 2009-05-30 18:09 . 2009-05-30 18:09 -------- d-----w- c:\programdata\Walgreens 2009-05-30 18:09 . 2009-05-30 18:09 -------- d-----w- c:\users\Jason Nordeman\AppData\Roaming\Walgreens 2009-05-30 18:09 . 2009-05-30 18:09 -------- d-----w- c:\program files\Common Files\HP 2009-05-30 18:09 . 2009-05-30 18:09 -------- d-----w- c:\program files\Walgreens 2009-05-27 20:05 . 2009-05-27 19:50 -------- d-----w- c:\program files\Coupons 2009-05-16 16:06 . 2009-05-16 16:06 416128 ----a-w- c:\programdata\Microsoft\eHome\Packages\NetTV\Browse\NetTVResources.dll 2009-05-14 07:00 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2009-05-03 23:00 . 2007-06-05 16:37 -------- d-----w- c:\program files\LimeWire 2009-04-24 16:05 . 2009-06-12 20:33 827904 ----a-w- c:\windows\system32\wininet.dll 2009-04-24 16:02 . 2009-06-12 20:33 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-04-24 13:44 . 2009-06-12 20:33 26624 ----a-w- c:\windows\system32\ieUnatt.exe 2009-04-23 12:43 . 2009-06-12 20:33 784896 ----a-w- c:\windows\system32\rpcrt4.dll 2007-05-09 21:21 . 2007-05-09 21:20 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT . ((((((((((((((((((((((((((((( SnapShot@2009-06-26_02.38.18 ))))))))))))))))))))))))))))))))))))))))) . + 2007-05-09 14:07 . 2009-07-01 00:22 45738 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2006-11-02 13:05 . 2009-07-01 00:53 64000 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2007-05-14 22:25 . 2009-07-01 00:53 14216 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2996572545-135866921-4033492168-1000_UserData.bin + 2006-11-02 13:02 . 2009-06-30 23:52 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\ Cookies\index.dat - 2006-11-02 13:02 . 2009-06-26 02:06 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\ Cookies\index.dat - 2006-11-02 13:02 . 2009-06-26 02:06 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Te mporary Internet Files\Content.IE5\index.dat + 2006-11-02 13:02 . 2009-06-30 23:52 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Te mporary Internet Files\Content.IE5\index.dat + 2006-11-02 13:02 . 2009-06-30 23:52 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Hi story\History.IE5\index.dat - 2006-11-02 13:02 . 2009-06-26 02:06 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Hi story\History.IE5\index.dat + 2007-05-17 00:20 . 2009-06-28 12:29 4522 c:\windows\System32\WDI\ERCQueuedResolutions.dat + 2009-07-01 00:43 . 2009-07-01 00:51 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2009-06-26 02:26 . 2009-06-26 02:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2009-07-01 00:43 . 2009-07-01 00:51 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-06-26 02:26 . 2009-06-26 02:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2007-05-14 22:59 . 2009-07-01 10:47 239774 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2006-11-02 10:33 . 2009-07-01 10:48 595684 c:\windows\System32\perfh009.dat - 2006-11-02 10:33 . 2009-06-26 02:34 595684 c:\windows\System32\perfh009.dat - 2006-11-02 10:33 . 2009-06-26 02:34 101350 c:\windows\System32\perfc009.dat + 2006-11-02 10:33 . 2009-07-01 10:48 101350 c:\windows\System32\perfc009.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-25 1948440] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\syste m] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\System32\avgrsstx.dll c:\windows\System32\avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDef end] @="Service" [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk backup=c:\windows\pss\Digital Line Detect.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickSet.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickSet.lnk backup=c:\windows\pss\QuickSet.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SCClient.exe.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\SCClient.exe.lnk backup=c:\windows\pss\SCClient.exe.lnk.CommonStartup backupExtension=.CommonStartup [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2996572545-135866921-4033492168-1000] "EnableNotificationsRef"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{30D18C48-2E87-4AB5-B5F5-5C5C90D409BE}"= UDP:c:\program files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent "{33ECB0B3-0BA8-4AEF-A847-3DE8AB30765A}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader "{752A2A26-7848-4B6F-95F5-99C961DD44D0}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader "{44AC46A5-5D40-4064-96EE-72C1852EB6F8}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{40AA8754-CC61-4C37-92CC-18E467D9FF9E}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{CAEDFBF3-8AC1-4501-9187-7B6C3AE33A99}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{2B0C8748-C298-4593-9A2C-F711CE3BF54B}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{565BCD25-E083-4F79-95BE-CA8B17076CBD}"= UDP:c:\users\Jason Nordeman\Desktop\Shared\LimeWire\LimeWire.exe:LimeWire "{C63E095A-D1A0-48BC-AB5A-453C57DB18E9}"= TCP:c:\users\Jason Nordeman\Desktop\Shared\LimeWire\LimeWire.exe:LimeWire "{1BEF7C0B-FA0A-4A4A-8C3F-4D27EA4F706D}"= UDP:c:\users\Jason Nordeman\Desktop\Office, pp, excel\Shared\LimeWire\LimeWire.exe:LimeWire "{ED31C1C4-A6AD-4BDD-95F3-FD502A945883}"= TCP:c:\users\Jason Nordeman\Desktop\Office, pp, excel\Shared\LimeWire\LimeWire.exe:LimeWire "{E0D5481E-022F-4EF1-8E73-ECBC0F06C920}"= UDP:c:\users\Jason Nordeman\Desktop\Shared\LimeWire\LimeWire.exe:LimeWire "{981B494F-F1CE-40FB-B17C-0AFD5C540E0E}"= TCP:c:\users\Jason Nordeman\Desktop\Shared\LimeWire\LimeWire.exe:LimeWire "TCP Query User{C4596475-1235-497F-A66C-B4D67FCAD7A9}c:\\program files\\internet explorer\\iexplore.exe"= Disabled:UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{AF475501-7225-430C-988D-2A6E013A29B5}c:\\program files\\internet explorer\\iexplore.exe"= Disabled:TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{1ADC034B-24D0-4A4E-8F68-68E50C690B8A}c:\\program files\\itunes\\itunes.exe"= UDP:c:\program files\itunes\itunes.exe:iTunes "UDP Query User{D4FF6448-E444-46D6-A271-BA1D2AFEA691}c:\\program files\\itunes\\itunes.exe"= TCP:c:\program files\itunes\itunes.exe:iTunes "TCP Query User{432D73F0-7642-43D9-87DC-9F68B74F2CE0}c:\\users\\jason nordeman\\desktop\\new folder (2)\\soulseek\\slsk.exe"= UDP:c:\users\jason nordeman\desktop\new folder (2)\soulseek\slsk.exe:slsk.exe "UDP Query User{FACFF2AA-A4F9-458E-95D1-F6CD1EE9F7B5}c:\\users\\jason nordeman\\desktop\\new folder (2)\\soulseek\\slsk.exe"= TCP:c:\users\jason nordeman\desktop\new folder (2)\soulseek\slsk.exe:slsk.exe "TCP Query User{322DAA30-8DA3-4C37-9C85-B5CEF9F40FE8}c:\\users\\jason nordeman\\desktop\\new folder\\soulseek\\slsk.exe"= UDP:c:\users\jason nordeman\desktop\new folder\soulseek\slsk.exe:slsk.exe "UDP Query User{9F5ED81A-1F16-4F64-AB61-F41C9897B5BD}c:\\users\\jason nordeman\\desktop\\new folder\\soulseek\\slsk.exe"= TCP:c:\users\jason nordeman\desktop\new folder\soulseek\slsk.exe:slsk.exe "TCP Query User{1751EDD1-3958-4FD3-95BD-A6B80B23B128}c:\\users\\jason nordeman\\desktop\\soulseek\\slsk.exe"= UDP:c:\users\jason nordeman\desktop\soulseek\slsk.exe:slsk.exe "UDP Query User{6A3D6779-DA09-4D53-8FC9-D81790679962}c:\\users\\jason nordeman\\desktop\\soulseek\\slsk.exe"= TCP:c:\users\jason nordeman\desktop\soulseek\slsk.exe:slsk.exe "{5612308F-E23E-41A3-8E8F-66EE85702116}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{6C62D755-6B0D-433F-BEE3-477E65302824}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{93EA2948-2AC6-4714-B668-CD8E389D7EB7}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{7FE49F12-FD2C-44D3-B448-A0332C9DCC27}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes "{A31D874D-C774-4C50-9B37-EFEACEDB7126}"= UDP:c:\windows\System32\dlcxcoms.exe:Lexmark Communications System "{53CACE5E-F6F6-43A2-9F4A-8DCE351D4777}"= TCP:c:\windows\System32\dlcxcoms.exe:Lexmark Communications System "{EBADB57F-E90E-40F5-84BD-6C96A9614010}"= UDP:c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe evice Monitor"{F598B523-83A8-4254-896D-63C7555B199C}"= TCP:c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe evice Monitor"{4D21C11A-78EA-451E-9EE6-F0972D57AB40}"= UDP:c:\program files\Dell Photo AIO Printer 926\dlcxaiox.exe:All In One Center "{EB5045ED-A6F7-4C5F-BC2E-141F40265387}"= TCP:c:\program files\Dell Photo AIO Printer 926\dlcxaiox.exe:All In One Center "{04133352-B104-419F-9DAC-EA90F86045E1}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe "{163E3D9F-747E-4609-862C-86EE434602CF}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [6/25/2009 7:41 AM 327688] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [6/25/2009 7:41 AM 108552] R2 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe -service --> c:\windows\system32\dlcxcoms.exe -service [?] R2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [1/15/2008 10:28 AM 204800] R2 scManager;SafeConnect Network manager ;c:\program files\Impulse\scManager.sys servicestart --> c:\program files\Impulse\scManager.sys servicestart [?] S4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [6/25/2009 7:41 AM 298776] --- Other Services/Drivers In Memory --- *NewlyCreated* - AUDIOSRV *NewlyCreated* - PROFSVC . . ------- Supplementary Scan ------- . uStart Page = https://webmail.wcupa.edu/exchweb/bi...ange/&reason=0 uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-01 07:30 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2009-07-01 7:34 ComboFix-quarantined-files.txt 2009-07-01 11:34 ComboFix2.txt 2009-07-01 01:18 ComboFix3.txt 2009-07-01 01:06 ComboFix4.txt 2009-07-01 00:16 ComboFix5.txt 2009-07-01 11:19 Pre-Run: 11,826,737,152 bytes free Post-Run: 11,632,582,656 bytes free 197 --- E O F --- 2009-06-30 21:04 Is there a different way of going about this.? |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 03:01 PM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile