ComboFix 10-04-12.03 - Owner 04/12/2010 20:54:43.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.1011 [GMT -7:00]
Running from: c:\users\Owner\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\vdwmg.sys
.
---- Previous Run -------
.
C:\confin.sys
c:\program files\gamevance\gamevancelib32.dll
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf
c:\program files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
c:\program files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTmlmu.dll
c:\program files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
c:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
c:\program files\MyWebSearch\bar\1.bin\F3SCrctr.dll
c:\program files\MyWebSearch\bar\1.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
c:\program files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE
c:\program files\MyWebSearch\bar\1.bin\M3HTML.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IDLE.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MEDINT.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MSg.dll
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3OUtlcn.dll
c:\program files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSSVC.EXE
c:\program files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
c:\program files\MyWebSearch\bar\Game\CHESS.F3S
c:\program files\MyWebSearch\bar\Game\REVERSI.F3S
c:\program files\MyWebSearch\bar\icons\CM.ICO
c:\program files\MyWebSearch\bar\icons\MFC.ICO
c:\program files\MyWebSearch\bar\icons\PSS.ICO
c:\program files\MyWebSearch\bar\icons\SMILEY.ICO
c:\program files\MyWebSearch\bar\icons\WB.ICO
c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
c:\program files\MyWebSearch\bar\Message\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\DOG.F3S
c:\program files\MyWebSearch\bar\Notifier\FISH.F3S
c:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
c:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
c:\program files\MyWebSearch\bar\Notifier\MAID.F3S
c:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
c:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
c:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
c:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
c:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\program files\MyWebSearch\SrchAstt\1.bin\MWSSrcas.dll
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\users\Guest\Desktop\PCenter.lnk
c:\windows\aBoBOY.exe
c:\windows\ACwqFn.exe
c:\windows\AEIgKke.dll
c:\windows\aieWRFXiL.exe
c:\windows\aiRKAoDC.exe
c:\windows\alAyBL.dll
c:\windows\aTsVh.exe
c:\windows\AVXpd.exe
c:\windows\AWWbL.exe
c:\windows\BcEnVsO.dll
c:\windows\bctaeWOj.dll
c:\windows\bdRMi.exe
c:\windows\bFshUh.dll
c:\windows\BlkiKQxd.exe
c:\windows\BmhbjKin.dll
c:\windows\BowDaCXUj.dll
c:\windows\bPaXA.dll
c:\windows\bPRqYA.dll
c:\windows\BTNmflWF.dll
c:\windows\bUlLGP.exe
c:\windows\BvmyugmX.exe
c:\windows\BwuKKXUc.dll
c:\windows\BYUuOSm.dll
c:\windows\cEFCJEDF.exe
c:\windows\CHrEfqCMW.dll
c:\windows\cibQQMsP.exe
c:\windows\CMOBGdgb.exe
c:\windows\CNnnbk.dll
c:\windows\cOnDbIQN.exe
c:\windows\cqwaB.dll
c:\windows\CTHUuSHwa.exe
c:\windows\ctuAx.dll
c:\windows\CvtOlxa.dll
c:\windows\cwHQOxet.exe
c:\windows\CWvANj.exe
c:\windows\DaEeJn.dll
c:\windows\dcjvDKo.dll
c:\windows\DgfbB.dll
c:\windows\DGkmPt.exe
c:\windows\DLIMWkC.dll
c:\windows\Downloaded Program Files\f3initialsetup1.0.1.0.inf
c:\windows\DOXgGkH.dll
c:\windows\DSWvfq.dll
c:\windows\DVwaTh.exe
c:\windows\DWEJNLp.exe
c:\windows\dYygcWw.exe
c:\windows\edoVtaQk.exe
c:\windows\eEWILqtN.dll
c:\windows\eJAbWCQgM.exe
c:\windows\ElFKBJpW.dll
c:\windows\ENrNEEiup.dll
c:\windows\epSwxDGeE.exe
c:\windows\ErMWn.dll
c:\windows\EWFrLn.dll
c:\windows\FfYmRcg.dll
c:\windows\fICsP.exe
c:\windows\fqAnfjpNl.exe
c:\windows\fsvWuSK.dll
c:\windows\fsYkEW.exe
c:\windows\GasrSAEAf.dll
c:\windows\GDYWYbchA.exe
c:\windows\GmAlHNpX.exe
c:\windows\GmEmbvXyV.exe
c:\windows\GMfUnKOri.dll
c:\windows\gMNtxkt.exe
c:\windows\GqOWFqO.exe
c:\windows\GVbtDnx.dll
c:\windows\GxueA.exe
c:\windows\hBthHq.exe
c:\windows\hFvggKx.dll
c:\windows\hhHmeuhv.exe
c:\windows\HKErfb.dll
c:\windows\hQBMUaAw.exe
c:\windows\HrooS.dll
c:\windows\hSRQm.dll
c:\windows\HvshS.dll
c:\windows\hYyqXW.dll
c:\windows\IEoedF.dll
c:\windows\IiBynTCs.exe
c:\windows\IJECTh.exe
c:\windows\IkxllJG.exe
c:\windows\IMqEs.dll
c:\windows\iuNpxX.dll
c:\windows\JBDdurQJ.exe
c:\windows\jdQAt.exe
c:\windows\jisfjAlIU.dll
c:\windows\jkKVk.dll
c:\windows\jLuQsaL.dll
c:\windows\JyUDOH.dll
c:\windows\kbnNrCRXd.dll
c:\windows\kExRIbilD.dll
c:\windows\kGwEn.dll
c:\windows\KIQnda.exe
c:\windows\klDhghSB.exe
c:\windows\KlNMhbFC.dll
c:\windows\KQntFGB.exe
c:\windows\LancRSJRj.dll
c:\windows\LbAngpuX.dll
c:\windows\LbckHBm.exe
c:\windows\LjLXNoE.exe
c:\windows\lkDucAV.dll
c:\windows\LmOsQ.dll
c:\windows\lPFESNW.dll
c:\windows\LuGqwuRJ.exe
c:\windows\mFDFLsXvY.exe
c:\windows\MfloBngl.exe
c:\windows\MgeNXuk.dll
c:\windows\MHCIWOl.dll
c:\windows\mjTsaubx.exe
c:\windows\mKkCDXB.exe
c:\windows\MMtqylGm.exe
c:\windows\MmxfHmRHi.dll
c:\windows\mnSuuux.dll
c:\windows\mnwpBfUK.dll
c:\windows\mspNWcBDY.dll
c:\windows\MyejgqHc.exe
c:\windows\naqmXFhrO.exe
c:\windows\NcjAH.dll
c:\windows\ncQoDjWV.dll
c:\windows\nCwvSRW.dll
c:\windows\NDiNt.dll
c:\windows\neEUETb.exe
c:\windows\nMaRi.dll
c:\windows\nrqWCrvVg.dll
c:\windows\NtaAWRdD.dll
c:\windows\ObqIi.dll
c:\windows\oDqeQcrfd.exe
c:\windows\ogPsagpeG.dll
c:\windows\OjUortcp.dll
c:\windows\oRpgGjH.dll
c:\windows\oxrNeokO.exe
c:\windows\pCKyb.dll
c:\windows\pdmyXmLy.dll
c:\windows\PeeXtxBw.dll
c:\windows\ptxKM.exe
c:\windows\PVbQGApeb.dll
c:\windows\pvilXrRJB.exe
c:\windows\qEdiYwOJq.dll
c:\windows\qIPIafWg.dll
c:\windows\qkVuQu.dll
c:\windows\QNQcNE.exe
c:\windows\qrWAKD.dll
c:\windows\QuSNcvLlT.exe
c:\windows\QvjxNdnxn.dll
c:\windows\QYGbH.exe
c:\windows\rdtRM.dll
c:\windows\RFrfb.dll
c:\windows\rGBfp.exe
c:\windows\rNXRdLwbE.dll
c:\windows\rWFNxYFMv.dll
c:\windows\rwlPnm.dll
c:\windows\rwOrDpkFf.dll
c:\windows\RxQMdVW.dll
c:\windows\rybDkM.dll
c:\windows\ryysnM.exe
c:\windows\sGnXd.dll
c:\windows\sHHEYF.exe
c:\windows\SIjBPLR.exe
c:\windows\SjmwggUPQ.exe
c:\windows\SOAodDyg.exe
c:\windows\SoJgg.dll
c:\windows\SqaDULOHG.dll
c:\windows\sQjPIL.dll
c:\windows\StjgY.exe
c:\windows\SUbhSJyPw.dll
c:\windows\system32\Alsmb.dll
c:\windows\system32\bLiRlnnSV.exe
c:\windows\system32\cEImCTJRF.dll
c:\windows\system32\cJRxQs.exe
c:\windows\system32\dbNWmOOt.exe
c:\windows\system32\DpQnIdJCC.dll
c:\windows\system32\drivers\Apkfx.exe
c:\windows\system32\drivers\axdSvKvq.exe
c:\windows\system32\drivers\bayRCK.exe
c:\windows\system32\drivers\bHGJCNH.exe
c:\windows\system32\drivers\BsfdU.exe
c:\windows\system32\drivers\CBvFdi.exe
c:\windows\system32\drivers\CGEaYniTN.exe
c:\windows\system32\drivers\cgwciqTD.dll
c:\windows\system32\drivers\DlnuO.exe
c:\windows\system32\drivers\dlPrHIJlR.dll
c:\windows\system32\drivers\DuJWe.exe
c:\windows\system32\drivers\eHElA.exe
c:\windows\system32\drivers\EOHNcCvIc.dll
c:\windows\system32\drivers\eVbUmPIB.exe
c:\windows\system32\drivers\fDAoQlMvc.exe
c:\windows\system32\drivers\FEpYPWufp.exe
c:\windows\system32\drivers\FSfvKf.exe
c:\windows\system32\drivers\gDpLpEtb.exe
c:\windows\system32\drivers\GjpWRYhSW.dll
c:\windows\system32\drivers\gnhovQTd.dll
c:\windows\system32\drivers\GouUA.dll
c:\windows\system32\drivers\grbjUlnI.dll
c:\windows\system32\drivers\HmKdBGu.dll
c:\windows\system32\drivers\hYGbkEFY.dll
c:\windows\system32\drivers\iLUwyC.dll
c:\windows\system32\drivers\iqhCKe.dll
c:\windows\system32\drivers\IqikD.dll
c:\windows\system32\drivers\IrtqxCxER.exe
c:\windows\system32\drivers\IsNJQgxN.dll
c:\windows\system32\drivers\jurYgIhyA.dll
c:\windows\system32\drivers\KBQyev.dll
c:\windows\system32\drivers\kJHtb.dll
c:\windows\system32\drivers\LssEiUU.exe
c:\windows\system32\drivers\lVYhJ.exe
c:\windows\system32\drivers\mhWGUpCtF.exe
c:\windows\system32\drivers\NLthwux.exe
c:\windows\system32\drivers\NOBpmAwC.dll
c:\windows\system32\drivers\NWLUDyJ.exe
c:\windows\system32\drivers\OBoIEXh.dll
c:\windows\system32\drivers\okFce.exe
c:\windows\system32\drivers\OwTTa.dll
c:\windows\system32\drivers\Pekfje.exe
c:\windows\system32\drivers\pxAvDtF.dll
c:\windows\system32\drivers\RCIkQUl.dll
c:\windows\system32\drivers\RPAqNk.exe
c:\windows\system32\drivers\rqfNAolQ.dll
c:\windows\system32\drivers\RrbQfW.exe
c:\windows\system32\drivers\SwqAC.exe
c:\windows\system32\drivers\ToMPW.exe
c:\windows\system32\drivers\UGhWrYV.dll
c:\windows\system32\drivers\UHFNH.exe
c:\windows\system32\drivers\urumEXI.dll
c:\windows\system32\drivers\USqYa.dll
c:\windows\system32\drivers\uWEAJ.dll
c:\windows\system32\drivers\vkjNEsil.exe
c:\windows\system32\drivers\VKrLBP.exe
c:\windows\system32\drivers\vpEswj.dll
c:\windows\system32\drivers\WIjxix.dll
c:\windows\system32\drivers\WmSSidd.dll
c:\windows\system32\drivers\wTeQfAp.exe
c:\windows\system32\drivers\XJLwjrlg.dll
c:\windows\system32\drivers\XlpRuVTAt.dll
c:\windows\system32\drivers\XMRMg.exe
c:\windows\system32\drivers\YcEwJm.dll
c:\windows\system32\drivers\yHDPIVHoK.exe
c:\windows\system32\drivers\YmMmTp.exe
c:\windows\system32\dWSfauoQR.exe
c:\windows\system32\EtcywDS.exe
c:\windows\system32\EXsbtWpIH.dll
c:\windows\system32\EYHKBEIaw.exe
c:\windows\system32\f3PSSavr.scr
c:\windows\system32\FflyJnuqM.exe
c:\windows\system32\FSkCVDr.dll
c:\windows\system32\GNWmbLxO.dll
c:\windows\system32\GYmXpVctu.exe
c:\windows\system32\haIEDoo.exe
c:\windows\system32\Hnhynm.dll
c:\windows\system32\iIKwxNH.exe
c:\windows\system32\iMxDWqEs.exe
c:\windows\system32\JaITQOq.exe
c:\windows\system32\jeecD.dll
c:\windows\system32\jQEkBD.dll
c:\windows\system32\JsepJ.dll
c:\windows\system32\KfgUbFp.exe
c:\windows\system32\KQfmQEg.exe
c:\windows\system32\kVewPVOce.exe
c:\windows\system32\KxKFtVmey.exe
c:\windows\system32\KyEmlPssf.dll
c:\windows\system32\LdRhd.exe
c:\windows\system32\LdUlgii.exe
c:\windows\system32\mfIOYAjiu.dll
c:\windows\system32\mhIfWVE.dll
c:\windows\system32\NFVSFYYyw.dll
c:\windows\system32\nuJahaCQY.dll
c:\windows\system32\NunwKfnMj.exe
c:\windows\system32\oRuoTJ.exe
c:\windows\system32\PbXCbjtkl.exe
c:\windows\system32\pJnjJp.dll
c:\windows\system32\PLsXNMoN.exe
c:\windows\system32\POvQvfQdD.dll
c:\windows\system32\qPWHlJPK.exe
c:\windows\system32\QvBbORrs.exe
c:\windows\system32\RIEiN.exe
c:\windows\system32\rTqiQC.dll
c:\windows\system32\SAaPCvjmS.exe
c:\windows\system32\smbeMaT.dll
c:\windows\system32\spool\prtprocs\w32x86\000054d4.tmp
c:\windows\system32\spool\prtprocs\w32x86\00006090.tmp
c:\windows\system32\SRkteJW.exe
c:\windows\system32\TNEfD.exe
c:\windows\system32\uePPYo.dll
c:\windows\system32\ufmei.exe
c:\windows\system32\UUPvV.dll
c:\windows\system32\UYQpq.exe
c:\windows\system32\vhSDwTDd.exe
c:\windows\system32\VIvKoHI.exe
c:\windows\system32\vvamV.dll
c:\windows\system32\WDxYsvcw.exe
c:\windows\system32\wlhDHmqA.dll
c:\windows\system32\wrlBtWaCm.dll
c:\windows\system32\WUFHhn.dll
c:\windows\system32\WwBaKmmU.dll
c:\windows\system32\xdEJYjxfr.exe
c:\windows\system32\XmrxDEw.dll
c:\windows\system32\xmVuFFFKo.dll
c:\windows\system32\XNhHBT.dll
c:\windows\system32\xQmxoNQhx.exe
c:\windows\system32\XSqQtUM.exe
c:\windows\system32\xXYTbpHx.exe
c:\windows\system32\YGEYvFEI.dll
c:\windows\system32\yobsK.exe
c:\windows\system32\YrCbPf.exe
c:\windows\system32\yrWvB.exe
c:\windows\system32\yVklpPH.exe
c:\windows\SyVFdrY.dll
c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
c:\windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
c:\windows\TfLWCVfIn.exe
c:\windows\ThvWLKI.dll
c:\windows\TiNfWBk.exe
c:\windows\trqpIp.dll
c:\windows\trtii.exe
c:\windows\tuBsKtF.dll
c:\windows\tVGAWiY.exe
c:\windows\UamIQxQ.exe
c:\windows\UBhroskt.exe
c:\windows\UCHIVhf.exe
c:\windows\ueWkVGwq.exe
c:\windows\ujOUBm.exe
c:\windows\Ukmcci.exe
c:\windows\UmTKHPH.dll
c:\windows\UMYKA.dll
c:\windows\unfkWSOvv.dll
c:\windows\uNYRDw.dll
c:\windows\UROWLt.dll
c:\windows\USHKvmC.exe
c:\windows\utvNdJyG.exe
c:\windows\UTxHW.dll
c:\windows\uvJtYT.exe
c:\windows\UVqJIl.exe
c:\windows\UVrYKJu.dll
c:\windows\uyFtLrR.exe
c:\windows\uYyXRKTH.dll
c:\windows\vAItvFl.exe
c:\windows\vCJoFNrO.exe
c:\windows\VcnhIw.dll
c:\windows\vgChmSgkP.dll
c:\windows\VGjAxAB.exe
c:\windows\vHmySf.dll
c:\windows\vJDPFfKE.exe
c:\windows\VKkBGb.exe
c:\windows\vlCiuQmy.dll
c:\windows\VljOHsOw.dll
c:\windows\VPxKDOGG.dll
c:\windows\vsOsWdMoL.exe
c:\windows\vYnbVNHq.exe
c:\windows\WDvsOoApS.dll
c:\windows\wESVIwq.dll
c:\windows\wfvVhOw.dll
c:\windows\WJDNkXt.dll
c:\windows\wPnUmwAsy.exe
c:\windows\wpTmBvJC.dll
c:\windows\WqlxRXm.exe
c:\windows\wslxtILF.exe
c:\windows\WTvkfqaf.dll
c:\windows\wxnfHKQIg.dll
c:\windows\XGHkNy.dll
c:\windows\XKSuWwp.dll
c:\windows\XpSXLaHWu.dll
c:\windows\xpVkh.dll
c:\windows\xQbSXiGxa.dll
c:\windows\xvBtT.exe
c:\windows\XvTjDR.dll
c:\windows\YaKLVLdeK.exe
c:\windows\YCUFPFgGA.dll
c:\windows\YFleDIswE.dll
c:\windows\yHyHcGvsd.dll
c:\windows\ymRVhgELR.dll
c:\windows\YnCygnWt.exe
c:\windows\ynTXeMo.dll
c:\windows\YqkHDO.dll
c:\windows\ySKKstGpb.dll
c:\windows\ySLwyKf.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_MyWebSearchService
-------\Service_ssko
((((((((((((((((((((((((( Files Created from 2010-03-13 to 2010-04-13 )))))))))))))))))))))))))))))))
.
2010-04-13 04:04 . 2010-04-13 04:04 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-04-13 04:04 . 2010-04-13 04:04 -------- d-----w- c:\users\Guest\AppData\Local\temp
2010-04-13 04:04 . 2010-04-13 04:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-04-13 03:39 . 2010-04-13 03:39 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\ESET
2010-04-13 03:33 . 2010-04-13 03:33 -------- d-----w- c:\program files\ESET
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\users\Owner\AppData\Roaming\Malwarebytes
2010-04-13 03:30 . 2010-03-30 07:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\programdata\Malwarebytes
2010-04-13 03:30 . 2010-03-30 07:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-13 03:06 . 2010-04-13 04:12 -------- d-----w- c:\windows\LMI8C57.tmp
2010-04-13 02:23 . 2010-04-13 02:23 -------- d-----w- c:\users\Owner\AppData\Local\ICS
2010-04-13 02:23 . 2010-04-13 03:26 -------- d-----w- c:\windows\LMIF5FE.tmp
2010-04-10 18:48 . 2010-04-10 18:50 -------- d-----w- c:\programdata\Roxio
2010-04-10 18:47 . 2010-04-10 18:48 -------- d-----w- c:\users\Owner\AppData\Roaming\Roxio
2010-04-06 03:38 . 2010-04-06 03:43 -------- d-----w- c:\users\Owner\AppData\Roaming\Amazon
2010-04-06 03:21 . 2010-04-06 03:21 -------- d-----w- c:\program files\PC Antivirus
2010-03-31 04:50 . 2010-03-31 04:50 -------- d-----w- c:\program files\AV7
2010-03-30 00:13 . 2010-03-30 00:13 96896 ----a-w- c:\windows\system32\drivers\epfwwfpr.sys
2010-03-30 00:12 . 2010-03-30 00:12 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-03-30 00:07 . 2010-03-30 00:07 134024 ----a-w- c:\windows\system32\drivers\eamonm.sys
2010-03-24 10:29 . 2010-03-24 10:54 -------- d-----w- c:\users\Owner\AppData\Roaming\BloodTies
2010-03-19 08:49 . 2010-03-19 08:49 -------- d-----w- c:\users\Owner\AppData\Roaming\Exent Technologies
2010-03-16 04:17 . 2010-03-16 04:17 -------- d-----w- c:\users\Owner\AppData\Roaming\G-HeadGames
2010-03-16 03:42 . 2010-03-16 03:43 -------- d-----w- c:\program files\Echoes of the Past - Royal House of Stone
2010-03-16 03:27 . 2010-03-16 03:28 -------- d-----w- c:\program files\Dark Tales - Edgar Allan Poe`s Murders in the Rue Morgue
2010-03-15 08:46 . 2010-03-15 08:46 -------- d-----w- c:\users\Owner\AppData\Roaming\Frogwares
2010-03-15 07:45 . 2010-03-15 07:45 -------- d-----w- c:\users\Owner\AppData\Roaming\QB9
2010-03-14 20:01 . 2010-03-14 20:01 -------- d-----w- c:\users\Guest\AppData\Roaming\Yahoo!
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-13 03:26 . 2009-12-02 06:55 -------- d-----w- c:\programdata\avg9
2010-04-12 04:06 . 2008-12-18 00:03 -------- d-----w- c:\programdata\Google Updater
2010-04-10 18:47 . 2006-12-06 21:13 -------- d-----w- c:\programdata\Sonic
2010-04-05 21:52 . 2006-12-06 21:13 -------- d---a-w- c:\program files\Common Files\LightScribe
2010-03-23 08:24 . 2006-12-06 21:32 -------- d-----w- c:\program files\Yahoo!
2010-03-23 08:24 . 2010-03-02 07:13 -------- d-----w- c:\program files\Shutter Island
2010-03-23 08:24 . 2010-01-07 08:53 -------- d-----w- c:\program files\Scrabble
2010-03-23 08:24 . 2009-04-12 20:32 -------- d-----w- c:\program files\Safari
2010-03-23 08:24 . 2008-12-18 00:24 -------- d-----w- c:\program files\Picasa2
2010-03-23 08:24 . 2006-12-06 21:34 -------- d-----w- c:\program files\Symantec
2010-03-23 08:24 . 2009-12-12 02:57 -------- d-----w- c:\program files\Jane Angel - Templar Mystery
2010-03-23 08:24 . 2008-12-28 07:42 -------- d-----w- c:\program files\Mars
2010-03-23 08:24 . 2006-12-06 21:34 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-03-16 08:13 . 2008-03-14 08:08 -------- d-----w- c:\program files\RealArcade
2010-03-10 07:27 . 2009-11-26 03:28 -------- d-----w- c:\program files\Escape the Museum 2
2010-03-02 08:00 . 2010-03-02 08:00 -------- d-----w- c:\users\Owner\AppData\Roaming\Merscom
2010-03-02 08:00 . 2010-03-02 08:00 -------- d-----w- c:\programdata\Merscom
2010-03-01 20:53 . 2007-05-07 02:43 738 ----a-w- c:\users\Owner\AppData\Roaming\wklnhst.dat
2010-02-26 05:20 . 2010-02-25 00:49 -------- d-----w- c:\programdata\STOPzilla!
2010-02-26 04:38 . 2010-02-26 01:00 9128 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-02-25 00:50 . 2010-02-25 00:50 -------- d-----w- c:\programdata\SITEguard
2010-02-25 00:49 . 2010-02-25 00:49 -------- d-----w- c:\program files\Common Files\iS3
2010-02-23 22:23 . 2009-12-19 21:32 680 ----a-w- c:\users\Owner\AppData\Local\d3d9caps.dat
2010-02-20 07:03 . 2007-03-11 23:40 -------- d-----w- c:\users\Owner\AppData\Roaming\Apple Computer
2010-02-20 06:58 . 2007-07-10 02:09 -------- d-----w- c:\programdata\Apple
2010-02-20 06:58 . 2010-02-20 06:58 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-02-18 07:49 . 2008-03-14 07:04 -------- d-----w- c:\programdata\JollyBear
2010-02-18 07:49 . 2010-02-18 07:49 -------- d-----w- c:\program files\Big City Adventure - Vancouver
2010-02-18 06:40 . 2010-02-18 06:40 -------- d-----w- c:\users\Owner\AppData\Roaming\Gestalt Games
2010-02-17 09:16 . 2010-02-16 08:37 -------- d-----w- c:\program files\Oberon Media
2010-02-17 08:13 . 2010-02-17 08:13 -------- d-----w- c:\programdata\GamersDigital
2010-02-17 08:13 . 2010-02-17 08:13 -------- d-----w- c:\users\Owner\AppData\Roaming\GamersDigital
2010-02-17 05:54 . 2010-02-17 05:54 -------- d-----w- c:\users\Owner\AppData\Roaming\Oberonv1001
2010-02-16 09:47 . 2010-02-16 09:47 -------- d-----w- c:\users\Owner\AppData\Roaming\Oberonv1002
2010-02-16 09:47 . 2010-02-16 09:47 -------- d-----w- c:\programdata\Yahoo!
2010-02-16 09:47 . 2010-02-16 09:47 -------- d-----w- c:\programdata\Oberon Media
2010-02-16 08:38 . 2010-02-16 08:38 -------- d-----w- c:\users\Owner\AppData\Roaming\Pogo Games
2010-01-19 08:04 . 2010-01-19 08:04 64 ----a-w- c:\windows\GPlrLanc.dat
2007-03-31 04:15 . 2007-03-31 04:15 22 --sha-w- c:\windows\SMINST\HPCD.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-18 39408]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"*LogMeInRescue_1246134705"="c:\windows\LMIFA26.tmp\lmi_rescue.exe" [2010-04-13 1874808]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
"Motive SmartBridge"="c:\progra~1\Verizon\SMARTB~1\MotiveSB.exe" [2006-06-23 438359]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-03-30 2145000]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-25 44136]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Exetender"="c:\program files\Free Ride Games\GPlayer.exe" [2009-12-01 1751552]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^Users^Owner^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnk.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-28 01:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2009-08-13 22:51 177440 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Exetender]
2009-12-01 03:51 1751552 ------w- c:\program files\Free Ride Games\GPlayer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 23:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2006-09-28 13:42 65536 ----a-w- c:\hp\support\hpsysdrv.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-01-23 03:16 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2006-12-08 23:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Antivirus]
2010-03-03 16:21 451728 ----a-w- c:\program files\PC Antivirus\PC_Antivirus.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 12:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-12-18 00:03 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-02-05 03:21 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(

R2 gupdate1c960a746915933;Google Update Service (gupdate1c960a746915933);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-12 133104]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-04-16 11520]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-03-30 114984]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-03-30 134024]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-03-30 810120]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-03-30 96896]
S2 X4HS32Ex;X4HS32Ex;c:\program files\Free Ride Games\X4HS32Ex.Sys [2009-04-07 53280]
S3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2006-11-22 336000]
S3 USB_RNDIS_VISTA;Westell WireSpeed Dual Connect Modem;c:\windows\system32\DRIVERS\usb8023.sys [2009-04-11 15872]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
2010-04-13 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-08-18 04:59]
2010-04-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-12-18 08:23]
2010-04-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-12-18 08:23]
2010-03-18 c:\windows\Tasks\HPCeeScheduleForOwner.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2006-12-06 23:04]
2010-04-13 c:\windows\Tasks\User_Feed_Synchronization-{FC1ABC51-161C-4AA3-B84E-CF387FDDEE82}.job
- c:\windows\system32\msfeedssync.exe [2010-01-21 04:56]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-12 21:16
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll nvstor32.sys >>UNKNOWN [0x909938C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x82fb5d24
\Driver\ACPI -> acpi.sys @ 0x80610d68
\Driver\atapi -> ataport.SYS @ 0x8071fa2c
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->user & kernel MBR OK
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-3889443645-261564860-3365275697-1000\¬ î* *]
@Allowed: (Read) (RestrictedCode)
"MachineID"=hex:3e,87,ce,3d,43,bd,18,00
DUMPHIVE0.003 (REGF)
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'Explorer.exe'(808)
c:\program files\Verizon\SmartBridge\SBHook.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\program files\Google\Update\1.2.183.23\GoogleCrashHandler.exe
c:\windows\RtHDVCpl.exe
c:\program files\Verizon\SmartBridge\MotiveSB.exe
c:\windows\System32\rundll32.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Internet Explorer\iexplore.exe
c:\program files\Internet Explorer\iexplore.exe
c:\users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TVHH72XG\Support-LogMeInRescue[1].exe
.
**************************************************************************
.
Completion time: 2010-04-12 21:24:45 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-13 04:24
Pre-Run: 178,221,404,160 bytes free
Post-Run: 178,390,859,776 bytes free
- - End Of File - - 71F491EB2EC6756B1DFD2FA214BEC106
ComboFix 10-04-19.08 - Owner 04/20/2010 16:07:49.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.892 [GMT -7:00]
Running from: c:\users\Owner\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\asam.exe
c:\windows\system32\%appdata%
.
((((((((((((((((((((((((( Files Created from 2010-03-20 to 2010-04-20 )))))))))))))))))))))))))))))))
.
2010-04-20 23:19 . 2010-04-20 23:21 -------- d-----w- c:\users\Owner\AppData\Local\temp
2010-04-20 23:19 . 2010-04-20 23:19 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-04-20 23:19 . 2010-04-20 23:19 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-04-20 23:19 . 2010-04-20 23:19 -------- d-----w- c:\users\Guest\AppData\Local\temp
2010-04-20 23:19 . 2010-04-20 23:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-04-20 22:59 . 2010-04-20 23:02 -------- d-----w- C:\32788R22FWJFW
2010-04-20 07:55 . 2010-04-20 07:55 60672 ----a-w- c:\users\Owner\AppData\Local\syssvc.exe
2010-04-20 07:53 . 2010-04-20 07:53 -------- d-----w- c:\users\Owner\AppData\Local\pifshtxri
2010-04-15 22:10 . 2010-02-20 23:06 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-04-15 22:09 . 2010-02-20 20:53 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-04-15 22:09 . 2010-02-20 23:05 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-04-14 20:37 . 2010-02-23 11:10 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-14 20:37 . 2010-02-23 11:10 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-14 20:36 . 2010-02-23 11:10 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-14 20:14 . 2010-03-05 14:01 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-04-14 20:13 . 2010-02-18 14:07 904576 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-04-14 20:13 . 2010-02-18 11:28 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2010-04-14 20:13 . 2010-02-18 13:30 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-04-14 20:12 . 2009-12-23 11:33 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-04-14 20:12 . 2010-01-13 17:34 98304 ----a-w- c:\windows\system32\cabview.dll
2010-04-13 20:19 . 2010-04-15 22:11 -------- d-----w- c:\programdata\Yahoo! Companion
2010-04-13 12:58 . 2010-04-13 12:58 -------- d-----w- c:\users\Owner\AppData\Local\ESET
2010-04-13 06:47 . 2010-01-23 09:26 2048 ----a-w- c:\windows\system32\tzres.dll
2010-04-13 06:47 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2010-04-13 06:47 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc.dll
2010-04-13 06:46 . 2010-01-25 08:21 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-04-13 06:46 . 2010-01-25 08:21 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-04-13 06:46 . 2010-01-25 08:21 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-04-13 06:46 . 2010-01-25 08:21 518144 ----a-w- c:\windows\system32\RMActivate.exe
2010-04-13 06:46 . 2010-01-25 12:00 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-04-13 06:46 . 2010-01-25 12:00 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-04-13 06:46 . 2010-01-25 11:58 332288 ----a-w- c:\windows\system32\msdrm.dll
2010-04-13 06:46 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll
2010-04-13 06:46 . 2010-01-06 15:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-04-13 06:46 . 2010-01-06 13:30 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-04-13 04:19 . 2010-04-13 04:20 -------- d-----w- c:\windows\LMIFA26.tmp
2010-04-13 03:39 . 2010-04-13 03:39 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\ESET
2010-04-13 03:33 . 2010-04-13 03:33 -------- d-----w- c:\program files\ESET
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\users\Owner\AppData\Roaming\Malwarebytes
2010-04-13 03:30 . 2010-03-30 07:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\programdata\Malwarebytes
2010-04-13 03:30 . 2010-03-30 07:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-13 03:06 . 2010-04-13 04:12 -------- d-----w- c:\windows\LMI8C57.tmp
2010-04-13 02:23 . 2010-04-13 02:23 -------- d-----w- c:\users\Owner\AppData\Local\ICS
2010-04-13 02:23 . 2010-04-13 03:26 -------- d-----w- c:\windows\LMIF5FE.tmp
2010-04-10 18:48 . 2010-04-10 18:50 -------- d-----w- c:\programdata\Roxio
2010-04-10 18:47 . 2010-04-10 18:48 -------- d-----w- c:\users\Owner\AppData\Roaming\Roxio
2010-04-06 03:38 . 2010-04-06 03:43 -------- d-----w- c:\users\Owner\AppData\Roaming\Amazon
2010-04-06 03:21 . 2010-04-06 03:21 -------- d-----w- c:\program files\PC Antivirus
2010-03-31 04:50 . 2010-03-31 04:50 -------- d-----w- c:\program files\AV7
2010-03-30 00:13 . 2010-03-30 00:13 96896 ----a-w- c:\windows\system32\drivers\epfwwfpr.sys
2010-03-30 00:12 . 2010-03-30 00:12 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-03-30 00:07 . 2010-03-30 00:07 134024 ----a-w- c:\windows\system32\drivers\eamonm.sys
2010-03-24 10:29 . 2010-03-24 10:54 -------- d-----w- c:\users\Owner\AppData\Roaming\BloodTies
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-19 22:16 . 2008-12-18 00:03 -------- d-----w- c:\programdata\Google Updater
2010-04-18 22:21 . 2007-02-10 03:56 72760 ----a-w- c:\users\Owner\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-18 22:11 . 2007-08-18 16:18 -------- d-----w- c:\program files\Google
2010-04-15 22:19 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-04-13 03:26 . 2009-12-02 06:55 -------- d-----w- c:\programdata\avg9
2010-04-10 18:47 . 2006-12-06 21:13 -------- d-----w- c:\programdata\Sonic
2010-04-05 21:52 . 2006-12-06 21:13 -------- d---a-w- c:\program files\Common Files\LightScribe
2010-03-23 08:24 . 2006-12-06 21:32 -------- d-----w- c:\program files\Yahoo!
2010-03-23 08:24 . 2010-03-02 07:13 -------- d-----w- c:\program files\Shutter Island
2010-03-23 08:24 . 2010-01-07 08:53 -------- d-----w- c:\program files\Scrabble
2010-03-23 08:24 . 2009-04-12 20:32 -------- d-----w- c:\program files\Safari
2010-03-23 08:24 . 2008-12-18 00:24 -------- d-----w- c:\program files\Picasa2
2010-03-23 08:24 . 2006-12-06 21:34 -------- d-----w- c:\program files\Symantec
2010-03-23 08:24 . 2009-12-12 02:57 -------- d-----w- c:\program files\Jane Angel - Templar Mystery
2010-03-23 08:24 . 2008-12-28 07:42 -------- d-----w- c:\program files\Mars
2010-03-23 08:24 . 2006-12-06 21:34 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-03-19 08:49 . 2010-03-19 08:49 -------- d-----w- c:\users\Owner\AppData\Roaming\Exent Technologies
2010-03-18 21:13 . 2010-03-18 21:13 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2010-03-16 08:13 . 2008-03-14 08:08 -------- d-----w- c:\program files\RealArcade
2010-03-16 04:17 . 2010-03-16 04:17 -------- d-----w- c:\users\Owner\AppData\Roaming\G-HeadGames
2010-03-16 03:43 . 2010-03-16 03:42 -------- d-----w- c:\program files\Echoes of the Past - Royal House of Stone
2010-03-16 03:28 . 2010-03-16 03:27 -------- d-----w- c:\program files\Dark Tales - Edgar Allan Poe`s Murders in the Rue Morgue
2010-03-15 08:46 . 2010-03-15 08:46 -------- d-----w- c:\users\Owner\AppData\Roaming\Frogwares
2010-03-15 07:45 . 2010-03-15 07:45 -------- d-----w- c:\users\Owner\AppData\Roaming\QB9
2010-03-14 20:01 . 2010-03-14 20:01 -------- d-----w- c:\users\Guest\AppData\Roaming\Yahoo!
2010-03-10 07:27 . 2009-11-26 03:28 -------- d-----w- c:\program files\Escape the Museum 2
2010-03-02 08:00 . 2010-03-02 08:00 -------- d-----w- c:\users\Owner\AppData\Roaming\Merscom
2010-03-02 08:00 . 2010-03-02 08:00 -------- d-----w- c:\programdata\Merscom
2010-03-01 20:53 . 2007-05-07 02:43 738 ----a-w- c:\users\Owner\AppData\Roaming\wklnhst.dat
2010-02-26 05:20 . 2010-02-25 00:49 -------- d-----w- c:\programdata\STOPzilla!
2010-02-26 04:38 . 2010-02-26 01:00 9128 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-02-25 00:50 . 2010-02-25 00:50 -------- d-----w- c:\programdata\SITEguard
2010-02-25 00:49 . 2010-02-25 00:49 -------- d-----w- c:\program files\Common Files\iS3
2010-02-23 22:23 . 2009-12-19 21:32 680 ----a-w- c:\users\Owner\AppData\Local\d3d9caps.dat
2010-02-23 06:39 . 2010-04-13 06:48 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-23 06:33 . 2010-04-13 06:48 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-02-23 06:33 . 2010-04-13 06:48 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-02-23 04:55 . 2010-04-13 06:48 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-02-20 07:03 . 2007-03-11 23:40 -------- d-----w- c:\users\Owner\AppData\Roaming\Apple Computer
2010-02-20 06:58 . 2007-07-10 02:09 -------- d-----w- c:\programdata\Apple
2010-02-20 06:58 . 2010-02-20 06:58 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-02-02 06:11 . 2010-02-02 06:11 72488 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2007-03-31 04:15 . 2007-03-31 04:15 22 --sha-w- c:\windows\SMINST\HPCD.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-18 39408]
"pjhstuqd"="c:\users\Owner\AppData\Local\pifshtxri\msektirtssd.exe" [2010-04-20 271616]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
"Motive SmartBridge"="c:\progra~1\Verizon\SMARTB~1\MotiveSB.exe" [2006-06-23 438359]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-03-30 2145000]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-25 44136]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Exetender"="c:\program files\Free Ride Games\GPlayer.exe" [2009-12-01 1751552]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^Users^Owner^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnk.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-28 01:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2009-08-13 22:51 177440 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Exetender]
2009-12-01 03:51 1751552 ------w- c:\program files\Free Ride Games\GPlayer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 23:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2006-09-28 13:42 65536 ----a-w- c:\hp\support\hpsysdrv.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-01-23 03:16 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2006-12-08 23:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Antivirus]
2010-03-03 16:21 451728 ----a-w- c:\program files\PC Antivirus\PC_Antivirus.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 12:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-12-18 00:03 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-02-05 03:21 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(

R2 gupdate1c960a746915933;Google Update Service (gupdate1c960a746915933);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-12 133104]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-03-30 38224]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-04-16 11520]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-03-30 114984]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-03-30 134024]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-03-30 810120]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-03-30 96896]
S2 X4HS32Ex;X4HS32Ex;c:\program files\Free Ride Games\X4HS32Ex.Sys [2009-04-07 53280]
S3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2006-11-22 336000]
S3 USB_RNDIS_VISTA;Westell WireSpeed Dual Connect Modem;c:\windows\system32\DRIVERS\usb8023.sys [2009-04-11 15872]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
2010-04-20 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-08-18 04:59]
2010-04-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-12-18 08:23]
2010-04-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-12-18 08:23]
2010-04-17 c:\windows\Tasks\HPCeeScheduleForOwner.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2006-12-06 23:04]
2010-04-20 c:\windows\Tasks\User_Feed_Synchronization-{FC1ABC51-161C-4AA3-B84E-CF387FDDEE82}.job
- c:\windows\system32\msfeedssync.exe [2010-04-13 04:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride = <local>
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-asam - c:\windows\asam.exe
HKLM-Run-asam - c:\windows\asam.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-20 16:22
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll nvstor32.sys >>UNKNOWN [0x908168C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x82fb8d24
\Driver\ACPI -> acpi.sys @ 0x80614d68
\Driver\atapi -> ataport.SYS @ 0x80723a2c
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->user & kernel MBR OK
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-3889443645-261564860-3365275697-1000\¬ î* *]
@Allowed: (Read) (RestrictedCode)
"MachineID"=hex:3e,87,ce,3d,43,bd,18,00
DUMPHIVE0.003 (REGF)
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'Explorer.exe'(3076)
c:\program files\Verizon\SmartBridge\SBHook.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\program files\Google\Update\1.2.183.23\GoogleCrashHandler.exe
c:\windows\RtHDVCpl.exe
c:\program files\Verizon\SmartBridge\MotiveSB.exe
c:\windows\System32\rundll32.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2010-04-20 16:32:16 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-20 23:32
ComboFix2.txt 2010-04-13 04:24
Pre-Run: 173,452,787,712 bytes free
Post-Run: 173,531,877,376 bytes free
- - End Of File - - 07EA5F5C6B359DE16969B1B331A21438
ComboFix 10-04-29.05 - Owner 05/04/2010 19:08:31.5.2 - x86
Running from: c:\users\Owner\Desktop\ComboFix.exe
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\%appdata%
.
((((((((((((((((((((((((( Files Created from 2010-04-05 to 2010-05-05 )))))))))))))))))))))))))))))))
.
2010-05-05 02:23 . 2010-05-05 02:27 -------- d-----w- c:\users\Owner\AppData\Local\temp
2010-05-05 02:23 . 2010-05-05 02:23 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-05-05 02:23 . 2010-05-05 02:23 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-05-05 02:23 . 2010-05-05 02:23 -------- d-----w- c:\users\Guest\AppData\Local\temp
2010-05-05 02:23 . 2010-05-05 02:23 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-05-05 01:57 . 2010-05-05 02:01 -------- d-----w- C:\32788R22FWJFW
2010-05-04 23:17 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-04 23:17 . 2010-05-04 23:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-04 23:17 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-03 07:43 . 2010-05-03 07:43 -------- d-----w- c:\users\Owner\AppData\Local\kbxmiurjx
2010-04-27 01:01 . 2010-04-27 01:01 -------- d-----w- c:\program files\iPod
2010-04-27 01:01 . 2010-04-27 01:03 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-27 01:01 . 2010-04-27 01:03 -------- d-----w- c:\program files\iTunes
2010-04-27 00:54 . 2010-04-27 00:54 -------- d-----w- c:\program files\Bonjour
2010-04-23 07:57 . 2010-04-23 07:57 -------- d-----w- c:\program files\The Treasures Of Montezuma
2010-04-22 23:55 . 2010-04-22 23:55 -------- d-----w- c:\users\Owner\AppData\Roaming\Arkadium
2010-04-22 06:52 . 2010-04-22 07:37 -------- d-----w- c:\users\Owner\AppData\Local\Brain Games Mahjongg Files
2010-04-22 05:31 . 2010-04-22 05:31 -------- d-----w- c:\programdata\Casual Box
2010-04-20 23:46 . 2010-04-20 23:47 -------- d-----w- c:\windows\LMICABD.tmp
2010-04-20 07:53 . 2010-04-23 20:50 -------- d-----w- c:\users\Owner\AppData\Local\pifshtxri
2010-04-15 22:10 . 2010-02-20 23:06 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-04-15 22:09 . 2010-02-20 20:53 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-04-15 22:09 . 2010-02-20 23:05 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-04-14 20:37 . 2010-02-23 11:10 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-14 20:37 . 2010-02-23 11:10 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-14 20:36 . 2010-02-23 11:10 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-14 20:14 . 2010-03-05 14:01 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-04-14 20:13 . 2010-02-18 14:07 904576 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-04-14 20:13 . 2010-02-18 11:28 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2010-04-14 20:13 . 2010-02-18 13:30 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-04-14 20:12 . 2009-12-23 11:33 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-04-14 20:12 . 2010-01-13 17:34 98304 ----a-w- c:\windows\system32\cabview.dll
2010-04-13 12:58 . 2010-04-13 12:58 -------- d-----w- c:\users\Owner\AppData\Local\ESET
2010-04-13 06:47 . 2010-01-23 09:26 2048 ----a-w- c:\windows\system32\tzres.dll
2010-04-13 06:47 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2010-04-13 06:47 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc.dll
2010-04-13 06:46 . 2010-01-25 08:21 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-04-13 06:46 . 2010-01-25 08:21 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-04-13 06:46 . 2010-01-25 08:21 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-04-13 06:46 . 2010-01-25 08:21 518144 ----a-w- c:\windows\system32\RMActivate.exe
2010-04-13 06:46 . 2010-01-25 12:00 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-04-13 06:46 . 2010-01-25 12:00 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-04-13 06:46 . 2010-01-25 11:58 332288 ----a-w- c:\windows\system32\msdrm.dll
2010-04-13 06:46 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll
2010-04-13 06:46 . 2010-01-06 15:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-04-13 06:46 . 2010-01-06 13:30 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-04-13 04:19 . 2010-04-13 04:20 -------- d-----w- c:\windows\LMIFA26.tmp
2010-04-13 03:39 . 2010-04-13 03:39 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\ESET
2010-04-13 03:33 . 2010-04-13 03:33 -------- d-----w- c:\program files\ESET
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\users\Owner\AppData\Roaming\Malwarebytes
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\programdata\Malwarebytes
2010-04-13 03:06 . 2010-04-13 04:12 -------- d-----w- c:\windows\LMI8C57.tmp
2010-04-13 02:23 . 2010-04-13 02:23 -------- d-----w- c:\users\Owner\AppData\Local\ICS
2010-04-13 02:23 . 2010-04-13 03:26 -------- d-----w- c:\windows\LMIF5FE.tmp
2010-04-10 18:48 . 2010-04-10 18:50 -------- d-----w- c:\programdata\Roxio
2010-04-10 18:47 . 2010-04-10 18:48 -------- d-----w- c:\users\Owner\AppData\Roaming\Roxio
2010-04-06 03:38 . 2010-04-06 03:43 -------- d-----w- c:\users\Owner\AppData\Roaming\Amazon
2010-04-06 03:21 . 2010-04-06 03:21 -------- d-----w- c:\program files\PC Antivirus
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-04 23:08 . 2009-12-19 21:32 1356 ----a-w- c:\users\Owner\AppData\Local\d3d9caps.dat
2010-05-03 08:53 . 2006-12-06 21:09 -------- d-----w- c:\program files\HP Games
2010-05-03 08:53 . 2006-12-06 21:12 -------- d-----w- c:\programdata\WildTangent
2010-04-27 01:01 . 2007-07-10 02:09 -------- d-----w- c:\program files\Common Files\Apple
2010-04-27 00:59 . 2008-10-18 03:47 -------- d-----w- c:\program files\QuickTime
2010-04-27 00:48 . 2010-04-27 00:48 73000 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
2010-04-23 07:54 . 2008-03-14 08:08 -------- d-----w- c:\program files\RealArcade
2010-04-22 18:34 . 2006-12-06 21:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-22 05:18 . 2009-03-22 06:23 -------- d-----w- c:\program files\bfgclient
2010-04-22 05:09 . 2006-12-06 21:08 -------- d-----w- c:\program files\Common Files\InstallShield
2010-04-21 02:07 . 2007-08-18 16:18 -------- d-----w- c:\program files\Google
2010-04-21 01:55 . 2006-12-06 21:32 -------- d-----w- c:\program files\Yahoo!
2010-04-21 01:49 . 2010-02-16 09:47 -------- d-----w- c:\programdata\Yahoo!
2010-04-21 01:45 . 2006-12-06 21:34 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-04-18 22:21 . 2007-02-10 03:56 72760 ----a-w- c:\users\Owner\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-15 22:19 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-04-13 03:26 . 2009-12-02 06:55 -------- d-----w- c:\programdata\avg9
2010-04-10 18:47 . 2006-12-06 21:13 -------- d-----w- c:\programdata\Sonic
2010-04-05 21:52 . 2006-12-06 21:13 -------- d---a-w- c:\program files\Common Files\LightScribe
2010-03-31 04:50 . 2010-03-31 04:50 -------- d-----w- c:\program files\AV7
2010-03-30 00:13 . 2010-03-30 00:13 96896 ----a-w- c:\windows\system32\drivers\epfwwfpr.sys
2010-03-30 00:12 . 2010-03-30 00:12 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-03-30 00:07 . 2010-03-30 00:07 134024 ----a-w- c:\windows\system32\drivers\eamonm.sys
2010-03-24 10:54 . 2010-03-24 10:29 -------- d-----w- c:\users\Owner\AppData\Roaming\BloodTies
2010-03-23 08:24 . 2010-01-07 08:53 -------- d-----w- c:\program files\Scrabble
2010-03-23 08:24 . 2009-04-12 20:32 -------- d-----w- c:\program files\Safari
2010-03-23 08:24 . 2008-12-18 00:24 -------- d-----w- c:\program files\Picasa2
2010-03-23 08:24 . 2009-12-12 02:57 -------- d-----w- c:\program files\Jane Angel - Templar Mystery
2010-03-23 08:24 . 2008-12-28 07:42 -------- d-----w- c:\program files\Mars
2010-03-19 08:49 . 2010-03-19 08:49 -------- d-----w- c:\users\Owner\AppData\Roaming\Exent Technologies
2010-03-18 21:13 . 2010-03-18 21:13 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2010-03-16 04:17 . 2010-03-16 04:17 -------- d-----w- c:\users\Owner\AppData\Roaming\G-HeadGames
2010-03-16 03:43 . 2010-03-16 03:42 -------- d-----w- c:\program files\Echoes of the Past - Royal House of Stone
2010-03-16 03:28 . 2010-03-16 03:27 -------- d-----w- c:\program files\Dark Tales - Edgar Allan Poe`s Murders in the Rue Morgue
2010-03-15 08:46 . 2010-03-15 08:46 -------- d-----w- c:\users\Owner\AppData\Roaming\Frogwares
2010-03-15 07:45 . 2010-03-15 07:45 -------- d-----w- c:\users\Owner\AppData\Roaming\QB9
2010-03-14 20:01 . 2010-03-14 20:01 -------- d-----w- c:\users\Guest\AppData\Roaming\Yahoo!
2010-03-10 07:27 . 2009-11-26 03:28 -------- d-----w- c:\program files\Escape the Museum 2
2010-03-01 20:53 . 2007-05-07 02:43 738 ----a-w- c:\users\Owner\AppData\Roaming\wklnhst.dat
2010-02-23 06:39 . 2010-04-13 06:48 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-23 06:33 . 2010-04-13 06:48 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-02-23 06:33 . 2010-04-13 06:48 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-02-23 04:55 . 2010-04-13 06:48 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-02-12 18:46 . 2010-02-12 18:46 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-02-12 18:46 . 2010-02-12 18:46 107808 ----a-w- c:\windows\system32\dns-sd.exe
2007-03-31 04:15 . 2007-03-31 04:15 22 --sha-w- c:\windows\SMINST\HPCD.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"vboabmjq"="c:\users\Owner\AppData\Local\kbxmiurjx\jhfofuatssd.exe" [2010-05-03 259328]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Motive SmartBridge"="c:\progra~1\Verizon\SMARTB~1\MotiveSB.exe" [2006-06-23 438359]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-03-30 2145000]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-17 47392]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-26 142120]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^Users^Owner^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnk.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-28 01:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 23:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2006-09-28 13:42 65536 ----a-w- c:\hp\support\hpsysdrv.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-03-26 08:10 142120 ----a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2006-12-08 23:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Antivirus]
2010-03-03 16:21 451728 ----a-w- c:\program files\PC Antivirus\PC_Antivirus.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 12:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-12-18 00:03 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-02-05 03:21 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(

R3 USB_RNDIS_VISTA;Westell WireSpeed Dual Connect Modem;c:\windows\system32\DRIVERS\usb8023.sys [2009-04-11 15872]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-04-16 11520]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-03-30 114984]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-03-30 134024]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-03-30 810120]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-03-30 96896]
S3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2006-11-22 336000]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
2010-04-17 c:\windows\Tasks\HPCeeScheduleForOwner.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2006-12-06 23:04]
2010-05-05 c:\windows\Tasks\User_Feed_Synchronization-{FC1ABC51-161C-4AA3-B84E-CF387FDDEE82}.job
- c:\windows\system32\msfeedssync.exe [2010-04-13 04:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
.
- - - - ORPHANS REMOVED - - - -
Toolbar-Locked - (no file)
MSConfigStartUp-AppleSyncNotifier - c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
MSConfigStartUp-Exetender - c:\program files\Free Ride Games\GPlayer.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-04 19:27
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll nvstor32.sys >>UNKNOWN [0x879428C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x82fb9d24
\Driver\ACPI -> acpi.sys @ 0x80614d68
\Driver\atapi -> ataport.SYS @ 0x80723a2c
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->user & kernel MBR OK
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-3889443645-261564860-3365275697-1000\¬ î* *]
@Allowed: (Read) (RestrictedCode)
"MachineID"=hex:3e,87,ce,3d,43,bd,18,00
DUMPHIVE0.003 (REGF)
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'Explorer.exe'(3532)
c:\program files\Verizon\SmartBridge\SBHook.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Verizon\SmartBridge\MotiveSB.exe
c:\windows\System32\rundll32.exe
c:\windows\ehome\ehmsas.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2010-05-04 19:37:42 - machine was rebooted
ComboFix-quarantined-files.txt 2010-05-05 02:37
ComboFix2.txt 2010-04-20 23:34
ComboFix3.txt 2010-04-13 04:24
Pre-Run: 185,969,635,328 bytes free
Post-Run: 186,005,155,840 bytes free
- - End Of File - - E44744FF8E6A15B09F6667F6D43007FE
ComboFix 10-04-29.05 - Owner 05/04/2010 22:05:50.6.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.1344 [GMT -7:00]
Running from: c:\users\Owner\Desktop\ComboFix.exe
* Resident AV is active
.
((((((((((((((((((((((((( Files Created from 2010-04-05 to 2010-05-05 )))))))))))))))))))))))))))))))
.
2010-05-05 05:20 . 2010-05-05 05:20 -------- d-----w- c:\users\Owner\AppData\Local\temp
2010-05-05 05:20 . 2010-05-05 05:20 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-05-05 05:20 . 2010-05-05 05:20 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-05-05 05:20 . 2010-05-05 05:20 -------- d-----w- c:\users\Guest\AppData\Local\temp
2010-05-05 05:20 . 2010-05-05 05:20 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-05-05 04:46 . 2010-05-05 04:46 -------- d-----w- c:\program files\trend micro
2010-05-05 04:46 . 2010-05-05 04:46 -------- d-----w- C:\rsit
2010-05-04 23:17 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-04 23:17 . 2010-05-04 23:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-04 23:17 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-27 01:01 . 2010-04-27 01:01 -------- d-----w- c:\program files\iPod
2010-04-27 01:01 . 2010-04-27 01:03 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-27 01:01 . 2010-04-27 01:03 -------- d-----w- c:\program files\iTunes
2010-04-27 00:54 . 2010-04-27 00:54 -------- d-----w- c:\program files\Bonjour
2010-04-27 00:48 . 2010-04-27 00:48 73000 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
2010-04-23 07:57 . 2010-04-23 07:57 -------- d-----w- c:\program files\The Treasures Of Montezuma
2010-04-22 23:55 . 2010-04-22 23:55 -------- d-----w- c:\users\Owner\AppData\Roaming\Arkadium
2010-04-22 06:52 . 2010-04-22 07:37 -------- d-----w- c:\users\Owner\AppData\Local\Brain Games Mahjongg Files
2010-04-22 05:31 . 2010-04-22 05:31 -------- d-----w- c:\programdata\Casual Box
2010-04-20 23:46 . 2010-04-20 23:47 -------- d-----w- c:\windows\LMICABD.tmp
2010-04-20 07:53 . 2010-04-23 20:50 -------- d-----w- c:\users\Owner\AppData\Local\pifshtxri
2010-04-15 22:10 . 2010-02-20 23:06 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-04-15 22:09 . 2010-02-20 20:53 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-04-15 22:09 . 2010-02-20 23:05 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-04-14 20:37 . 2010-02-23 11:10 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-14 20:37 . 2010-02-23 11:10 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-14 20:36 . 2010-02-23 11:10 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-14 20:14 . 2010-03-05 14:01 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-04-14 20:13 . 2010-02-18 14:07 904576 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-04-14 20:13 . 2010-02-18 11:28 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2010-04-14 20:13 . 2010-02-18 13:30 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-04-14 20:12 . 2009-12-23 11:33 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-04-14 20:12 . 2010-01-13 17:34 98304 ----a-w- c:\windows\system32\cabview.dll
2010-04-13 12:58 . 2010-04-13 12:58 -------- d-----w- c:\users\Owner\AppData\Local\ESET
2010-04-13 06:47 . 2010-01-23 09:26 2048 ----a-w- c:\windows\system32\tzres.dll
2010-04-13 06:47 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2010-04-13 06:47 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc.dll
2010-04-13 06:46 . 2010-01-25 08:21 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-04-13 06:46 . 2010-01-25 08:21 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-04-13 06:46 . 2010-01-25 08:21 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-04-13 06:46 . 2010-01-25 08:21 518144 ----a-w- c:\windows\system32\RMActivate.exe
2010-04-13 06:46 . 2010-01-25 12:00 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-04-13 06:46 . 2010-01-25 12:00 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-04-13 06:46 . 2010-01-25 11:58 332288 ----a-w- c:\windows\system32\msdrm.dll
2010-04-13 06:46 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll
2010-04-13 06:46 . 2010-01-06 15:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-04-13 06:46 . 2010-01-06 13:30 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-04-13 04:19 . 2010-04-13 04:20 -------- d-----w- c:\windows\LMIFA26.tmp
2010-04-13 03:39 . 2010-04-13 03:39 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\ESET
2010-04-13 03:33 . 2010-04-13 03:33 -------- d-----w- c:\program files\ESET
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\users\Owner\AppData\Roaming\Malwarebytes
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\programdata\Malwarebytes
2010-04-13 03:06 . 2010-04-13 04:12 -------- d-----w- c:\windows\LMI8C57.tmp
2010-04-13 02:23 . 2010-04-13 02:23 -------- d-----w- c:\users\Owner\AppData\Local\ICS
2010-04-13 02:23 . 2010-04-13 03:26 -------- d-----w- c:\windows\LMIF5FE.tmp
2010-04-10 18:48 . 2010-04-10 18:50 -------- d-----w- c:\programdata\Roxio
2010-04-10 18:47 . 2010-04-10 18:48 -------- d-----w- c:\users\Owner\AppData\Roaming\Roxio
2010-04-06 03:38 . 2010-04-06 03:43 -------- d-----w- c:\users\Owner\AppData\Roaming\Amazon
2010-04-06 03:21 . 2010-04-06 03:21 -------- d-----w- c:\program files\PC Antivirus
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-05 02:50 . 2009-08-19 01:54 265688 ----a-w- c:\windows\system32\drivers\acpi.sys.copy
2010-05-05 02:50 . 2009-08-19 01:54 265688 ----a-w- c:\windows\system32\drivers\acpi.sys
2010-05-04 23:08 . 2009-12-19 21:32 1356 ----a-w- c:\users\Owner\AppData\Local\d3d9caps.dat
2010-05-03 08:53 . 2006-12-06 21:09 -------- d-----w- c:\program files\HP Games
2010-05-03 08:53 . 2006-12-06 21:12 -------- d-----w- c:\programdata\WildTangent
2010-04-27 01:01 . 2007-07-10 02:09 -------- d-----w- c:\program files\Common Files\Apple
2010-04-27 00:59 . 2008-10-18 03:47 -------- d-----w- c:\program files\QuickTime
2010-04-23 07:54 . 2008-03-14 08:08 -------- d-----w- c:\program files\RealArcade
2010-04-22 18:34 . 2006-12-06 21:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-22 05:18 . 2009-03-22 06:23 -------- d-----w- c:\program files\bfgclient
2010-04-22 05:09 . 2006-12-06 21:08 -------- d-----w- c:\program files\Common Files\InstallShield
2010-04-21 02:07 . 2007-08-18 16:18 -------- d-----w- c:\program files\Google
2010-04-21 01:55 . 2006-12-06 21:32 -------- d-----w- c:\program files\Yahoo!
2010-04-21 01:49 . 2010-02-16 09:47 -------- d-----w- c:\programdata\Yahoo!
2010-04-21 01:45 . 2006-12-06 21:34 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-04-18 22:21 . 2007-02-10 03:56 72760 ----a-w- c:\users\Owner\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-15 22:19 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-04-13 03:26 . 2009-12-02 06:55 -------- d-----w- c:\programdata\avg9
2010-04-10 18:47 . 2006-12-06 21:13 -------- d-----w- c:\programdata\Sonic
2010-04-05 21:52 . 2006-12-06 21:13 -------- d---a-w- c:\program files\Common Files\LightScribe
2010-03-31 04:50 . 2010-03-31 04:50 -------- d-----w- c:\program files\AV7
2010-03-30 00:13 . 2010-03-30 00:13 96896 ----a-w- c:\windows\system32\drivers\epfwwfpr.sys
2010-03-30 00:12 . 2010-03-30 00:12 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-03-30 00:07 . 2010-03-30 00:07 134024 ----a-w- c:\windows\system32\drivers\eamonm.sys
2010-03-24 10:54 . 2010-03-24 10:29 -------- d-----w- c:\users\Owner\AppData\Roaming\BloodTies
2010-03-23 08:24 . 2010-01-07 08:53 -------- d-----w- c:\program files\Scrabble
2010-03-23 08:24 . 2009-04-12 20:32 -------- d-----w- c:\program files\Safari
2010-03-23 08:24 . 2008-12-18 00:24 -------- d-----w- c:\program files\Picasa2
2010-03-23 08:24 . 2009-12-12 02:57 -------- d-----w- c:\program files\Jane Angel - Templar Mystery
2010-03-23 08:24 . 2008-12-28 07:42 -------- d-----w- c:\program files\Mars
2010-03-19 08:49 . 2010-03-19 08:49 -------- d-----w- c:\users\Owner\AppData\Roaming\Exent Technologies
2010-03-18 21:13 . 2010-03-18 21:13 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2010-03-16 04:17 . 2010-03-16 04:17 -------- d-----w- c:\users\Owner\AppData\Roaming\G-HeadGames
2010-03-16 03:43 . 2010-03-16 03:42 -------- d-----w- c:\program files\Echoes of the Past - Royal House of Stone
2010-03-16 03:28 . 2010-03-16 03:27 -------- d-----w- c:\program files\Dark Tales - Edgar Allan Poe`s Murders in the Rue Morgue
2010-03-15 08:46 . 2010-03-15 08:46 -------- d-----w- c:\users\Owner\AppData\Roaming\Frogwares
2010-03-15 07:45 . 2010-03-15 07:45 -------- d-----w- c:\users\Owner\AppData\Roaming\QB9
2010-03-14 20:01 . 2010-03-14 20:01 -------- d-----w- c:\users\Guest\AppData\Roaming\Yahoo!
2010-03-10 07:27 . 2009-11-26 03:28 -------- d-----w- c:\program files\Escape the Museum 2
2010-03-01 20:53 . 2007-05-07 02:43 738 ----a-w- c:\users\Owner\AppData\Roaming\wklnhst.dat
2010-02-23 06:39 . 2010-04-13 06:48 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-23 06:33 . 2010-04-13 06:48 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-02-23 06:33 . 2010-04-13 06:48 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-02-23 04:55 . 2010-04-13 06:48 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-02-12 18:46 . 2010-02-12 18:46 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-02-12 18:46 . 2010-02-12 18:46 107808 ----a-w- c:\windows\system32\dns-sd.exe
2007-03-31 04:15 . 2007-03-31 04:15 22 --sha-w- c:\windows\SMINST\HPCD.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Motive SmartBridge"="c:\progra~1\Verizon\SMARTB~1\MotiveSB.exe" [2006-06-23 438359]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-03-30 2145000]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-17 47392]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-26 142120]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^Users^Owner^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnk.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-28 01:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 23:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2006-09-28 13:42 65536 ----a-w- c:\hp\support\hpsysdrv.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-03-26 08:10 142120 ----a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2006-12-08 23:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Antivirus]
2010-03-03 16:21 451728 ----a-w- c:\program files\PC Antivirus\PC_Antivirus.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 12:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-12-18 00:03 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-02-05 03:21 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(

R3 USB_RNDIS_VISTA;Westell WireSpeed Dual Connect Modem;c:\windows\system32\DRIVERS\usb8023.sys [2009-04-11 15872]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-04-16 11520]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-03-30 114984]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-03-30 134024]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-03-30 810120]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-03-30 96896]
S3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2006-11-22 336000]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
2010-04-17 c:\windows\Tasks\HPCeeScheduleForOwner.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2006-12-06 23:04]
2010-05-05 c:\windows\Tasks\User_Feed_Synchronization-{FC1ABC51-161C-4AA3-B84E-CF387FDDEE82}.job
- c:\windows\system32\msfeedssync.exe [2010-04-13 04:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-04 22:20
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll nvstor32.sys >>UNKNOWN [0x873BC8C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x87bbad24
\Driver\ACPI -> acpi.sys @ 0x82613d68
\Driver\atapi -> ataport.SYS @ 0x82722a2c
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->user & kernel MBR OK
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-3889443645-261564860-3365275697-1000\¬ î* *]
@Allowed: (Read) (RestrictedCode)
"MachineID"=hex:3e,87,ce,3d,43,bd,18,00
DUMPHIVE0.003 (REGF)
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2010-05-04 22:23:30
ComboFix-quarantined-files.txt 2010-05-05 05:23
ComboFix2.txt 2010-05-05 02:37
ComboFix3.txt 2010-04-20 23:34
ComboFix4.txt 2010-04-13 04:24
Pre-Run: 185,900,961,792 bytes free
Post-Run: 185,872,973,824 bytes free
- - End Of File - - 74189462C5A3365339548A20C25E989E
ComboFix 10-05-10.05 - Owner 05/11/2010 20:56:19.7.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.1357 [GMT -7:00]
Running from: F:\ComboFix.exe
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\AV7
c:\program files\AV7\antivirus7.exe.tmp1
c:\users\Owner\GoToAssistDownloadHelper.exe
.
((((((((((((((((((((((((( Files Created from 2010-04-12 to 2010-05-12 )))))))))))))))))))))))))))))))
.
2010-05-12 04:08 . 2010-05-12 04:09 -------- d-----w- c:\users\Owner\AppData\Local\temp
2010-05-12 04:08 . 2010-05-12 04:08 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-05-12 04:08 . 2010-05-12 04:08 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-05-12 04:08 . 2010-05-12 04:08 -------- d-----w- c:\users\Guest\AppData\Local\temp
2010-05-12 04:08 . 2010-05-12 04:08 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-05-12 03:42 . 2010-05-12 03:44 -------- d-----w- C:\32788R22FWJFW
2010-05-12 03:31 . 2010-05-12 03:31 -------- d-----w- c:\program files\CCleaner
2010-05-12 02:36 . 2010-05-12 02:36 93056 ----a-w- C:\kwlcapow.sys
2010-05-05 04:46 . 2010-05-05 04:46 -------- d-----w- c:\program files\trend micro
2010-05-05 04:46 . 2010-05-05 04:46 -------- d-----w- C:\rsit
2010-05-04 23:17 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-04 23:17 . 2010-05-04 23:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-04 23:17 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-27 01:01 . 2010-04-27 01:01 -------- d-----w- c:\program files\iPod
2010-04-27 01:01 . 2010-04-27 01:03 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-27 01:01 . 2010-04-27 01:03 -------- d-----w- c:\program files\iTunes
2010-04-27 00:54 . 2010-04-27 00:54 -------- d-----w- c:\program files\Bonjour
2010-04-27 00:48 . 2010-04-27 00:48 73000 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
2010-04-23 07:57 . 2010-04-23 07:57 -------- d-----w- c:\program files\The Treasures Of Montezuma
2010-04-22 23:55 . 2010-04-22 23:55 -------- d-----w- c:\users\Owner\AppData\Roaming\Arkadium
2010-04-22 06:52 . 2010-04-22 07:37 -------- d-----w- c:\users\Owner\AppData\Local\Brain Games Mahjongg Files
2010-04-22 05:31 . 2010-04-22 05:31 -------- d-----w- c:\programdata\Casual Box
2010-04-20 23:46 . 2010-04-20 23:47 -------- d-----w- c:\windows\LMICABD.tmp
2010-04-20 07:53 . 2010-04-23 20:50 -------- d-----w- c:\users\Owner\AppData\Local\pifshtxri
2010-04-15 22:10 . 2010-02-20 23:06 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-04-15 22:09 . 2010-02-20 20:53 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-04-15 22:09 . 2010-02-20 23:05 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-04-14 20:37 . 2010-02-23 11:10 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-14 20:37 . 2010-02-23 11:10 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-14 20:36 . 2010-02-23 11:10 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-14 20:14 . 2010-03-05 14:01 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-04-14 20:13 . 2010-02-18 14:07 904576 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-04-14 20:13 . 2010-02-18 11:28 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2010-04-14 20:13 . 2010-02-18 13:30 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-04-14 20:12 . 2009-12-23 11:33 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-04-14 20:12 . 2010-01-13 17:34 98304 ----a-w- c:\windows\system32\cabview.dll
2010-04-13 12:58 . 2010-04-13 12:58 -------- d-----w- c:\users\Owner\AppData\Local\ESET
2010-04-13 06:47 . 2010-01-23 09:26 2048 ----a-w- c:\windows\system32\tzres.dll
2010-04-13 06:47 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2010-04-13 06:47 . 2010-01-25 12:00 471552 ----a-w- c:\windows\system32\secproc.dll
2010-04-13 06:46 . 2010-01-25 08:21 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-04-13 06:46 . 2010-01-25 08:21 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-04-13 06:46 . 2010-01-25 08:21 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-04-13 06:46 . 2010-01-25 08:21 518144 ----a-w- c:\windows\system32\RMActivate.exe
2010-04-13 06:46 . 2010-01-25 12:00 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-04-13 06:46 . 2010-01-25 12:00 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-04-13 06:46 . 2010-01-25 11:58 332288 ----a-w- c:\windows\system32\msdrm.dll
2010-04-13 06:46 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll
2010-04-13 06:46 . 2010-01-06 15:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-04-13 06:46 . 2010-01-06 13:30 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-04-13 04:19 . 2010-04-13 04:20 -------- d-----w- c:\windows\LMIFA26.tmp
2010-04-13 03:39 . 2010-04-13 03:39 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\ESET
2010-04-13 03:33 . 2010-04-13 03:33 -------- d-----w- c:\program files\ESET
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\users\Owner\AppData\Roaming\Malwarebytes
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\programdata\Malwarebytes
2010-04-13 03:06 . 2010-04-13 04:12 -------- d-----w- c:\windows\LMI8C57.tmp
2010-04-13 02:23 . 2010-04-13 02:23 -------- d-----w- c:\users\Owner\AppData\Local\ICS
2010-04-13 02:23 . 2010-04-13 03:26 -------- d-----w- c:\windows\LMIF5FE.tmp
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-12 03:26 . 2009-12-19 21:32 1356 ----a-w- c:\users\Owner\AppData\Local\d3d9caps.dat
2010-05-05 05:30 . 2009-08-19 01:54 265688 ----a-w- c:\windows\system32\drivers\acpi.sys
2010-05-05 02:50 . 2009-08-19 01:54 265688 ----a-w- c:\windows\system32\drivers\acpi.sys.copy
2010-05-03 08:53 . 2006-12-06 21:09 -------- d-----w- c:\program files\HP Games
2010-05-03 08:53 . 2006-12-06 21:12 -------- d-----w- c:\programdata\WildTangent
2010-04-27 01:01 . 2007-07-10 02:09 -------- d-----w- c:\program files\Common Files\Apple
2010-04-27 00:59 . 2008-10-18 03:47 -------- d-----w- c:\program files\QuickTime
2010-04-23 07:54 . 2008-03-14 08:08 -------- d-----w- c:\program files\RealArcade
2010-04-22 18:34 . 2006-12-06 21:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-22 05:18 . 2009-03-22 06:23 -------- d-----w- c:\program files\bfgclient
2010-04-22 05:09 . 2006-12-06 21:08 -------- d-----w- c:\program files\Common Files\InstallShield
2010-04-21 02:07 . 2007-08-18 16:18 -------- d-----w- c:\program files\Google
2010-04-21 01:55 . 2006-12-06 21:32 -------- d-----w- c:\program files\Yahoo!
2010-04-21 01:49 . 2010-02-16 09:47 -------- d-----w- c:\programdata\Yahoo!
2010-04-21 01:45 . 2006-12-06 21:34 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-04-18 22:21 . 2007-02-10 03:56 72760 ----a-w- c:\users\Owner\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-15 22:19 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-04-13 03:26 . 2009-12-02 06:55 -------- d-----w- c:\programdata\avg9
2010-04-10 18:50 . 2010-04-10 18:48 -------- d-----w- c:\programdata\Roxio
2010-04-10 18:48 . 2010-04-10 18:47 -------- d-----w- c:\users\Owner\AppData\Roaming\Roxio
2010-04-10 18:47 . 2006-12-06 21:13 -------- d-----w- c:\programdata\Sonic
2010-04-06 03:43 . 2010-04-06 03:38 -------- d-----w- c:\users\Owner\AppData\Roaming\Amazon
2010-04-06 03:21 . 2010-04-06 03:21 -------- d-----w- c:\program files\PC Antivirus
2010-04-05 21:52 . 2006-12-06 21:13 -------- d---a-w- c:\program files\Common Files\LightScribe
2010-03-30 00:13 . 2010-03-30 00:13 96896 ----a-w- c:\windows\system32\drivers\epfwwfpr.sys
2010-03-30 00:12 . 2010-03-30 00:12 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-03-30 00:07 . 2010-03-30 00:07 134024 ----a-w- c:\windows\system32\drivers\eamonm.sys
2010-03-24 10:54 . 2010-03-24 10:29 -------- d-----w- c:\users\Owner\AppData\Roaming\BloodTies
2010-03-23 08:24 . 2010-01-07 08:53 -------- d-----w- c:\program files\Scrabble
2010-03-23 08:24 . 2009-04-12 20:32 -------- d-----w- c:\program files\Safari
2010-03-23 08:24 . 2008-12-18 00:24 -------- d-----w- c:\program files\Picasa2
2010-03-23 08:24 . 2009-12-12 02:57 -------- d-----w- c:\program files\Jane Angel - Templar Mystery
2010-03-23 08:24 . 2008-12-28 07:42 -------- d-----w- c:\program files\Mars
2010-03-19 08:49 . 2010-03-19 08:49 -------- d-----w- c:\users\Owner\AppData\Roaming\Exent Technologies
2010-03-18 21:13 . 2010-03-18 21:13 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2010-03-16 04:17 . 2010-03-16 04:17 -------- d-----w- c:\users\Owner\AppData\Roaming\G-HeadGames
2010-03-16 03:43 . 2010-03-16 03:42 -------- d-----w- c:\program files\Echoes of the Past - Royal House of Stone
2010-03-16 03:28 . 2010-03-16 03:27 -------- d-----w- c:\program files\Dark Tales - Edgar Allan Poe`s Murders in the Rue Morgue
2010-03-15 08:46 . 2010-03-15 08:46 -------- d-----w- c:\users\Owner\AppData\Roaming\Frogwares
2010-03-15 07:45 . 2010-03-15 07:45 -------- d-----w- c:\users\Owner\AppData\Roaming\QB9
2010-03-14 20:01 . 2010-03-14 20:01 -------- d-----w- c:\users\Guest\AppData\Roaming\Yahoo!
2010-03-01 20:53 . 2007-05-07 02:43 738 ----a-w- c:\users\Owner\AppData\Roaming\wklnhst.dat
2010-02-23 06:39 . 2010-04-13 06:48 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-23 06:33 . 2010-04-13 06:48 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-02-23 06:33 . 2010-04-13 06:48 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-02-23 04:55 . 2010-04-13 06:48 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-02-12 18:46 . 2010-02-12 18:46 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-02-12 18:46 . 2010-02-12 18:46 107808 ----a-w- c:\windows\system32\dns-sd.exe
2007-03-31 04:15 . 2007-03-31 04:15 22 --sha-w- c:\windows\SMINST\HPCD.sys
.
((((((((((((((((((((((((((((( SnapShot@2010-05-05_05.20.41 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-11-02 07:28 . 2006-11-02 08:48 84480 c:\windows\winsxs\x86_microsoft-windows-mail-comm-dll_31bf3856ad364e35_6.0.6002.18197_none_7b3d56a455f59b03\INETRES.dll
+ 2006-11-02 07:28 . 2006-11-02 08:48 84480 c:\windows\winsxs\x86_microsoft-windows-mail-comm-dll_31bf3856ad364e35_6.0.6001.18416_none_79ac63d2588f4d00\INETRES.dll
+ 2006-12-06 21:46 . 2010-05-12 03:55 79922 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2010-05-12 03:55 86144 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2007-02-10 04:32 . 2010-05-12 03:55 23316 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3889443645-261564860-3365275697-1000_UserData.bin
- 2007-02-10 04:32 . 2010-05-05 05:05 23316 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3889443645-261564860-3365275697-1000_UserData.bin
+ 2007-02-10 03:43 . 2010-05-12 04:03 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2007-02-10 03:43 . 2010-05-03 19:07 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2007-02-10 03:43 . 2010-05-12 04:03 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2007-02-10 03:43 . 2010-05-03 19:07 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2007-02-11 06:24 . 2010-05-05 04:42 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2007-02-11 06:24 . 2010-05-12 03:27 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2007-02-11 06:24 . 2010-05-05 04:42 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2007-02-11 06:24 . 2010-05-12 03:27 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2007-02-11 06:24 . 2010-05-12 03:27 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2007-02-11 06:24 . 2010-05-05 04:42 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-05-05 05:03 . 2010-05-05 05:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-05-12 03:53 . 2010-05-12 03:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-05-12 03:53 . 2010-05-12 03:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2010-05-05 05:03 . 2010-05-05 05:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2006-11-02 10:33 . 2010-05-05 05:11 595446 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2010-05-12 04:00 595446 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2010-05-05 05:11 101144 c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2010-05-12 04:00 101144 c:\windows\System32\perfc009.dat
- 2007-02-10 03:43 . 2010-05-03 19:07 147456 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2007-02-10 03:43 . 2010-05-12 04:03 147456 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2006-11-02 12:34 . 2006-11-02 12:34 2836992 c:\windows\winsxs\x86_microsoft-windows-mail-core-dll_31bf3856ad364e35_6.0.6002.18197_none_5a0aedc022b31946\MSOERES.dll
+ 2006-11-02 12:34 . 2006-11-02 12:34 2836992 c:\windows\winsxs\x86_microsoft-windows-mail-core-dll_31bf3856ad364e35_6.0.6001.18416_none_5879faee254ccb43\MSOERES.dll
+ 2006-11-02 10:22 . 2010-05-12 03:52 6553600 c:\windows\System32\SMI\Store\Machine\schema.dat
- 2006-11-02 10:22 . 2010-04-28 21:07 6553600 c:\windows\System32\SMI\Store\Machine\schema.dat
+ 2009-05-30 17:44 . 2010-05-12 03:45 118035670 c:\windows\winsxs\ManifestCache\6.0.6002.18005_001c11ba_blobs.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Motive SmartBridge"="c:\progra~1\Verizon\SMARTB~1\MotiveSB.exe" [2006-06-23 438359]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-03-30 2145000]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-17 47392]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-26 142120]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^Users^Owner^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnk.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-28 01:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 23:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2006-09-28 13:42 65536 ----a-w- c:\hp\support\hpsysdrv.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-03-26 08:10 142120 ----a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2006-12-08 23:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Antivirus]
2010-03-03 16:21 451728 ----a-w- c:\program files\PC Antivirus\PC_Antivirus.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 12:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-12-18 00:03 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-02-05 03:21 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(

R3 USB_RNDIS_VISTA;Westell WireSpeed Dual Connect Modem;c:\windows\system32\DRIVERS\usb8023.sys [2009-04-11 15872]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-04-16 11520]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-03-30 114984]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-03-30 134024]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-03-30 810120]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-03-30 96896]
S3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2006-11-22 336000]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
2010-04-17 c:\windows\Tasks\HPCeeScheduleForOwner.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2006-12-06 23:04]
2010-05-12 c:\windows\Tasks\User_Feed_Synchronization-{FC1ABC51-161C-4AA3-B84E-CF387FDDEE82}.job
- c:\windows\system32\msfeedssync.exe [2010-04-13 04:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-11 21:09
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll nvstor32.sys >>UNKNOWN [0x8795D8C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x87bc0d24
\Driver\ACPI -> acpi.sys @ 0x8260fd68
\Driver\atapi -> ataport.SYS @ 0x8271ea2c
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->user & kernel MBR OK
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-3889443645-261564860-3365275697-1000\¬ î* *]
@Allowed: (Read) (RestrictedCode)
"MachineID"=hex:3e,87,ce,3d,43,bd,18,00
DUMPHIVE0.003 (REGF)
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2010-05-11 21:12:59
ComboFix-quarantined-files.txt 2010-05-12 04:12
ComboFix2.txt 2010-05-05 05:23
ComboFix3.txt 2010-05-05 02:37
ComboFix4.txt 2010-04-20 23:34
ComboFix5.txt 2010-05-12 03:45
Pre-Run: 231,614,238,720 bytes free
Post-Run: 231,586,725,888 bytes free
- - End Of File - - E566098520B7FC791F8CB65E658B0BE5
Combo fix failed to remove the rootkit, so I tried using Microsoft’s Malware removal and it detected and removed a 3 different infections. I was unable to save the log as the system blue-screened.
ESET is no longer reporting the presence of Olmairk Trojan, so I reran Combofix but PEV.cfxxe fails so I'm not sure if the root kit was removed.
Here are the logs you have requested:
DDS (Ver_10-03-17.01) - NTFSx86
Run by Owner at 9:14:54.08 on Sat 05/15/2010
Internet Explorer: 8.0.6001.18904 BrowserJavaVersion: 1.6.0_17
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.1187 [GMT -7:00]
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\rundll32.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\taskeng.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Owner\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
mURLSearchHooks: H - No File
mURLSearchHooks: H - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No File
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
mRun: [NvCplDaemon] "RUNDLL32.EXE" c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] "RUNDLL32.EXE" c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {5E638779-1818-4754-A595-EF1C63B87A56} - c:\program files\norton systemworks basic edition\norton cleanup\WCQuick.lnk
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
============= SERVICES / DRIVERS ===============
R3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2006-12-6 336000]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-5-26 21504]
S3 QJFS;QJFS;c:\users\owner\appdata\local\temp\qjfs.exe --> c:\users\owner\appdata\local\temp\QJFS.exe [?]
S3 RBLVRADEV;RBLVRADEV;c:\users\owner\appdata\local\temp\rblvradev.exe --> c:\users\owner\appdata\local\temp\RBLVRADEV.exe [?]
S3 USB_RNDIS_VISTA;Westell WireSpeed Dual Connect Modem;c:\windows\system32\drivers\usb8023.sys [2009-8-18 15872]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-4-16 11520]
=============== Created Last 30 ================
2010-05-13 00:35:37 0 d-sh--w- C:\$RECYCLE.BIN
2010-05-12 21:58:47 98816 ----a-w- c:\windows\sed.exe
2010-05-12 21:58:47 77312 ----a-w- c:\windows\MBR.exe
2010-05-12 21:58:47 256512 ----a-w- c:\windows\PEV.exe
2010-05-12 21:58:47 161792 ----a-w- c:\windows\SWREG.exe
2010-05-12 21:10:27 738816 ----a-w- c:\windows\system32\inetcomm.dll
2010-05-12 19:28:52 110112 ----a-w- c:\windows\system32\drivers\NVSTOR32.SYS
2010-05-12 14:41:44 0 d-----w- c:\windows\system32\MpEngineStore
2010-05-12 06:41:05 88495282 ----a-w- c:\windows\system32\ZTGOXH
2010-05-12 03:31:42 0 d-----w- c:\program files\CCleaner
2010-05-12 02:36:56 93056 ----a-w- C:\kwlcapow.sys
2010-05-05 04:46:03 0 d-----w- c:\program files\trend micro
2010-04-27 01:01:55 0 d-----w- c:\program files\iPod
2010-04-27 01:01:53 0 d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-27 01:01:53 0 d-----w- c:\program files\iTunes
2010-04-27 00:54:28 0 d-----w- c:\program files\Bonjour
2010-04-23 07:57:20 0 d-----w- c:\program files\The Treasures Of Montezuma
2010-04-22 23:55:53 0 d-----w- c:\users\owner\appdata\roaming\Arkadium
2010-04-22 05:31:17 0 d-----w- c:\programdata\Casual Box
2010-04-20 23:46:49 0 d-----w- c:\windows\LMICABD.tmp
2010-04-15 22:18:37 208 ----a-w- c:\windows\system32\MRT.INI
2010-04-15 22:10:07 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-04-15 22:09:59 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-04-15 22:09:57 30720 ----a-w- c:\windows\system32\httpapi.dll
==================== Find3M ====================
2010-05-05 05:30:35 265688 ----a-w- c:\windows\system32\drivers\acpi.sys
2010-05-05 02:50:54 265688 ----a-w- c:\windows\system32\drivers\acpi.sys.copy
2010-04-27 00:55:22 86016 ----a-w- c:\windows\inf\infstor.dat
2010-04-27 00:55:22 51200 ----a-w- c:\windows\inf\infpub.dat
2010-04-27 00:55:22 143360 ----a-w- c:\windows\inf\infstrng.dat
2010-03-05 14:01:02 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-01 20:53:36 738 ----a-w- c:\users\owner\appdata\roaming\wklnhst.dat
2010-02-23 06:39:13 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-23 06:33:45 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-02-23 06:33:45 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-02-23 04:55:36 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-02-18 14:07:05 3600776 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-18 14:07:05 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-18 13:30:03 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2009-11-17 22:41:45 665600 ----a-w- c:\windows\inf\drvindex.dat
2008-07-30 06:10:59 174 --sha-w- c:\program files\desktop.ini
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-10-16 21:40:11 245760 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2007-03-31 04:15:27 22 --sha-w- c:\windows\sminst\HPCD.sys
2009-03-24 21:44:32 32768 --sha-w- c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\mshist012009032420090325\index.dat
2010-02-13 04:47:31 245760 --sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat
============= FINISH: 9:15:02.91 ===============
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_10-03-17.01)
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 12/25/2006 6:07:50 AM
System Uptime: 5/15/2010 9:07:07 AM (0 hours ago)
Motherboard: ASUSTek Computer INC. | | NODUSM3
Processor: AMD Athlon 64 X2 Dual Core Processor 5000+ | Socket AM2 | 2600/200mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 366 GiB total, 211.241 GiB free.
D: is FIXED (NTFS) - 6 GiB total, 0.881 GiB free.
E: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable
J: is Removable
==== Disabled Device Manager Items =============
==== System Restore Points ===================
RP1209: 5/11/2010 8:35:44 PM - Windows Update
==== Installed Programs ======================
ABBYY FineReader 6.0 Sprint
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.1
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AutoUpdate
Big City Adventure - San Francisco
Big City Adventure: New York
Big City Adventure: Vancouver
Big Fish Games: Game Manager
Bonjour
CCleaner
CheckIt Diagnostics
City Sights - Hello, Seattle!
DAK Wave and MP3 Editor v4.2b
DePopper 2.x
DivX
Enhanced Multimedia Keyboard Solution
Escape The Museum
Escape the Museum 2
Garmin City Navigator North America v8
Google Photos Screensaver
Google Toolbar for Internet Explorer
Google Update Helper
Hardware Diagnostic Tools
Haunted Hotel II: Believe the Lies
Hidden Expedition: Everest ™
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Advisor
HP Customer Experience Enhancements
HP Customer Feedback
HP Easy Setup - Core
HP Easy Setup - Frontend
HP Picasso Media Center Add-In
HP Update
iPhone Configuration Utility
iTunes
Jane Angel: Templar Mystery
Java 6 Update 17
Keys to Manhattan
LightScribe 1.4.124.1
LUXOR Adventures
Mahjong Fortuna 2
Microsoft .NET Framework 3.5 SP1
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
MobileMe Control Panel
MSN
MSXML 4.0 SP2 (KB973688)
muvee autoProducer 5.0
My HP Games
Mystery Case Files: Madame Fate
Mystery Case Files: Ravenhearst ™
Mystery Case Files: Return to Ravenhearst ™
Mystery P.I. - The Lottery Ticket
Mystery P.I. Special Edition Bundle
NVIDIA Drivers
OcxSetup
Photo Viewer
Picasa 3
Python 2.4.3
QuickTime
Rangy Lil's Wild West Adventure
RealPlayer
Realtek High Definition Audio Driver
Route 66
Roxio Creator Audio
Roxio Creator Basic v9
Roxio Creator Copy
Roxio Creator Data
Roxio Creator EasyArchive
Roxio Creator Tools
Roxio Express Labeler 3
Safari
SCRABBLE
Scrabble 2.1
Soft Data Fax Modem with SmartCP
Sony Picture Utility
The Treasures Of Montezuma
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Virtual Earth 3D (Beta)
Weather Exchange
Windows Driver Package - Sony DPP-FP60/70/90 (02/22/2007 6.0.6000.44)
Yard Sale Hidden Treasures: Sunnyville
==== Event Viewer Messages From Past Week ========
5/15/2010 9:09:09 AM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
5/15/2010 9:09:09 AM, Error: Service Control Manager [7000] - The eamonm service failed to start due to the following error: The system cannot find the file specified.
5/15/2010 9:07:30 AM, Error: Microsoft-Windows-TerminalServices-RemoteConnectionManager [1057] - The Terminal Server has failed to create a new self signed certificate to be used for Terminal Server authentication on SSL connections. The relevant status code was Key not valid for use in specified state. .
5/12/2010 7:30:57 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
5/12/2010 7:28:53 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: spldr Wanarpv6
5/12/2010 7:28:53 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
5/12/2010 7:27:58 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
5/12/2010 7:27:53 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
5/12/2010 7:27:44 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
5/12/2010 7:27:28 PM, Error: Microsoft-Windows-TerminalServices-LocalSessionManager [1048] - Terminal Service start failed. The relevant status code was This service cannot be started in Safe Mode .
5/12/2010 7:27:28 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service TermService with arguments "" in order to run the server: {F9A874B6-F8A8-4D73-B5A8-AB610816828B}
5/12/2010 7:20:48 AM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
5/12/2010 7:15:36 AM, Error: EventLog [6008] - The previous system shutdown at 7:13:24 AM on 5/12/2010 was unexpected.
5/12/2010 6:32:12 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Windows Vista (KB979683).
5/12/2010 5:34:27 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
5/12/2010 5:29:51 PM, Error: Service Control Manager [7034] - The XAudioService service terminated unexpectedly. It has done this 1 time(s).
5/12/2010 4:44:33 PM, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
5/12/2010 3:13:19 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: ehdrv spldr Wanarpv6
5/12/2010 12:29:26 AM, Error: Service Control Manager [7034] - The QJFS service terminated unexpectedly. It has done this 1 time(s).
5/11/2010 8:45:48 PM, Error: Microsoft-Windows-Servicing [4375] - Windows Servicing failed to complete the process of setting package KB978542 (Security Update) into Resolved(Resolved) state
5/11/2010 8:39:02 PM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
5/11/2010 11:37:45 PM, Error: Service Control Manager [7030] - The QJFS service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
5/11/2010 11:34:19 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the RBLVRADEV service to connect.
5/11/2010 11:34:19 PM, Error: Service Control Manager [7000] - The RBLVRADEV service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
5/11/2010 11:33:48 PM, Error: Service Control Manager [7030] - The RBLVRADEV service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
==== End Of File ===========================
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-05-15 11:43:50
Windows 6.0.6002 Service Pack 2
Running: gamer.exe; Driver: C:\Users\Owner\AppData\Local\Temp\kwlcapow.sys
---- Kernel code sections - GMER 1.0.15 ----
.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8B401340, 0x3DA8C7, 0xE8000020]
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
And the most recent combofix in which PEV.cfxxe fails
ComboFix 10-05-10.05 - Owner 05/15/2010 11:57:41.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.966 [GMT -7:00]
Running from: c:\users\Owner\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2010-04-15 to 2010-05-15 )))))))))))))))))))))))))))))))
.
2010-05-15 19:01 . 2010-05-15 19:01 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-05-15 19:01 . 2010-05-15 19:01 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-05-15 19:01 . 2010-05-15 19:01 -------- d-----w- c:\users\Owner\AppData\Local\temp
2010-05-15 19:01 . 2010-05-15 19:01 -------- d-----w- c:\users\Guest\AppData\Local\temp
2010-05-15 19:01 . 2010-05-15 19:01 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-05-12 21:10 . 2010-01-29 15:40 738816 ----a-w- c:\windows\system32\inetcomm.dll
2010-05-12 19:28 . 2010-05-12 19:28 110112 ----a-w- c:\windows\system32\drivers\NVSTOR32.SYS
2010-05-12 14:41 . 2010-05-12 20:02 -------- d-----w- c:\windows\system32\MpEngineStore
2010-05-12 03:31 . 2010-05-12 03:31 -------- d-----w- c:\program files\CCleaner
2010-05-12 02:36 . 2010-05-12 02:36 93056 ----a-w- C:\kwlcapow.sys
2010-04-27 01:01 . 2010-04-27 01:01 -------- d-----w- c:\program files\iPod
2010-04-27 01:01 . 2010-04-27 01:03 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-27 01:01 . 2010-04-27 01:03 -------- d-----w- c:\program files\iTunes
2010-04-27 00:54 . 2010-04-27 00:54 -------- d-----w- c:\program files\Bonjour
2010-04-27 00:48 . 2010-04-27 00:48 73000 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
2010-04-23 07:57 . 2010-04-23 07:57 -------- d-----w- c:\program files\The Treasures Of Montezuma
2010-04-22 23:55 . 2010-04-22 23:55 -------- d-----w- c:\users\Owner\AppData\Roaming\Arkadium
2010-04-22 06:52 . 2010-04-22 07:37 -------- d-----w- c:\users\Owner\AppData\Local\Brain Games Mahjongg Files
2010-04-22 05:31 . 2010-04-22 05:31 -------- d-----w- c:\programdata\Casual Box
2010-04-20 23:46 . 2010-04-20 23:47 -------- d-----w- c:\windows\LMICABD.tmp
2010-04-15 22:10 . 2010-02-20 23:06 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-04-15 22:09 . 2010-02-20 20:53 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-04-15 22:09 . 2010-02-20 23:05 30720 ----a-w- c:\windows\system32\httpapi.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-12 23:57 . 2007-03-04 02:39 -------- d-----w- c:\program files\Verizon
2010-05-12 21:13 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-05-12 03:26 . 2009-12-19 21:32 1356 ----a-w- c:\users\Owner\AppData\Local\d3d9caps.dat
2010-05-05 05:30 . 2009-08-19 01:54 265688 ----a-w- c:\windows\system32\drivers\acpi.sys
2010-05-05 02:50 . 2009-08-19 01:54 265688 ----a-w- c:\windows\system32\drivers\acpi.sys.copy
2010-05-03 08:53 . 2006-12-06 21:09 -------- d-----w- c:\program files\HP Games
2010-05-03 08:53 . 2006-12-06 21:12 -------- d-----w- c:\programdata\WildTangent
2010-04-27 01:01 . 2007-07-10 02:09 -------- d-----w- c:\program files\Common Files\Apple
2010-04-27 00:59 . 2008-10-18 03:47 -------- d-----w- c:\program files\QuickTime
2010-04-23 07:54 . 2008-03-14 08:08 -------- d-----w- c:\program files\RealArcade
2010-04-22 18:34 . 2006-12-06 21:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-22 05:18 . 2009-03-22 06:23 -------- d-----w- c:\program files\bfgclient
2010-04-22 05:09 . 2006-12-06 21:08 -------- d-----w- c:\program files\Common Files\InstallShield
2010-04-21 02:07 . 2007-08-18 16:18 -------- d-----w- c:\program files\Google
2010-04-21 01:55 . 2006-12-06 21:32 -------- d-----w- c:\program files\Yahoo!
2010-04-21 01:49 . 2010-02-16 09:47 -------- d-----w- c:\programdata\Yahoo!
2010-04-21 01:45 . 2006-12-06 21:34 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-04-18 22:21 . 2007-02-10 03:56 72760 ----a-w- c:\users\Owner\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-13 03:30 . 2010-04-13 03:30 -------- d-----w- c:\users\Owner\AppData\Roaming\Malwarebytes
2010-04-10 18:50 . 2010-04-10 18:48 -------- d-----w- c:\programdata\Roxio
2010-04-10 18:48 . 2010-04-10 18:47 -------- d-----w- c:\users\Owner\AppData\Roaming\Roxio
2010-04-10 18:47 . 2006-12-06 21:13 -------- d-----w- c:\programdata\Sonic
2010-04-06 03:43 . 2010-04-06 03:38 -------- d-----w- c:\users\Owner\AppData\Roaming\Amazon
2010-04-05 21:52 . 2006-12-06 21:13 -------- d---a-w- c:\program files\Common Files\LightScribe
2010-03-24 10:54 . 2010-03-24 10:29 -------- d-----w- c:\users\Owner\AppData\Roaming\BloodTies
2010-03-23 08:24 . 2010-01-07 08:53 -------- d-----w- c:\program files\Scrabble
2010-03-23 08:24 . 2009-04-12 20:32 -------- d-----w- c:\program files\Safari
2010-03-23 08:24 . 2008-12-18 00:24 -------- d-----w- c:\program files\Picasa2
2010-03-23 08:24 . 2009-12-12 02:57 -------- d-----w- c:\program files\Jane Angel - Templar Mystery
2010-03-23 08:24 . 2008-12-28 07:42 -------- d-----w- c:\program files\Mars
2010-03-19 08:49 . 2010-03-19 08:49 -------- d-----w- c:\users\Owner\AppData\Roaming\Exent Technologies
2010-03-18 21:13 . 2010-03-18 21:13 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2010-03-05 14:01 . 2010-04-14 20:14 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-01 20:53 . 2007-05-07 02:43 738 ----a-w- c:\users\Owner\AppData\Roaming\wklnhst.dat
2010-02-23 11:10 . 2010-04-14 20:37 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-02-23 11:10 . 2010-04-14 20:37 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-02-23 11:10 . 2010-04-14 20:36 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-23 06:39 . 2010-04-13 06:48 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-23 06:33 . 2010-04-13 06:48 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-02-23 06:33 . 2010-04-13 06:48 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-02-23 04:55 . 2010-04-13 06:48 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-02-18 14:07 . 2010-04-14 20:13 904576 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-02-18 14:07 . 2010-04-14 20:14 3600776 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-18 14:07 . 2010-04-14 20:14 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-18 13:30 . 2010-04-14 20:13 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-02-18 11:28 . 2010-04-14 20:13 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2007-03-31 04:15 . 2007-03-31 04:15 22 --sha-w- c:\windows\SMINST\HPCD.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^Users^Owner^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=c:\windows\pss\Picture Motion Browser Media Check Tool.lnk.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2010-03-17 04:58 47392 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 23:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2006-09-28 13:42 65536 ----a-w- c:\hp\support\hpsysdrv.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-03-26 08:10 142120 ----a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2006-12-08 23:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-18 04:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 12:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-12-18 00:03 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-02-05 03:21 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(

R1 lhmopayo;lhmopayo;c:\windows\system32\drivers\lhmopayo.sys [x]
R1 MpKsl364f009f;MpKsl364f009f;c:\windows\system32\MpEngineStore\MpKsl364f009f.sys [x]
R2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
R3 QJFS;QJFS;c:\users\Owner\AppData\Local\Temp\QJFS.exe [x]
R3 RBLVRADEV;RBLVRADEV;c:\users\Owner\AppData\Local\Temp\RBLVRADEV.exe [x]
R3 USB_RNDIS_VISTA;Westell WireSpeed Dual Connect Modem;c:\windows\system32\DRIVERS\usb8023.sys [2009-04-11 15872]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-04-16 11520]
S3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2006-11-22 336000]
--- Other Services/Drivers In Memory ---
*Deregistered* - kwlcapow
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
2010-04-17 c:\windows\Tasks\HPCeeScheduleForOwner.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2006-12-06 23:04]
2010-05-15 c:\windows\Tasks\User_Feed_Synchronization-{FC1ABC51-161C-4AA3-B84E-CF387FDDEE82}.job
- c:\windows\system32\msfeedssync.exe [2010-04-13 04:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-15 12:01
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes ...
[0] 0x00020207
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-3889443645-261564860-3365275697-1000\¬ î* *]
@Allowed: (Read) (RestrictedCode)
"MachineID"=hex:3e,87,ce,3d,43,bd,18,00
DUMPHIVE0.003 (REGF)
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2010-05-15 12:02:55
ComboFix-quarantined-files.txt 2010-05-15 19:02
Pre-Run: 226,935,336,960 bytes free
Post-Run: 226,926,825,472 bytes free
- - End Of File - - 48C9363CC646E4106B1AE46538D3AE3E