I ran combofix and I would like a little help with the log
ComboFix 10-06-01.01 - Owner 02.06.2010 11:57:25.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3326.2941 [GMT 2:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
((((((((((((((((((((((((( Files Created from 2010-05-02 to 2010-06-02 )))))))))))))))))))))))))))))))
.
2010-06-01 15:53 . 2010-06-02 09:54 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-06-01 15:53 . 2010-06-02 09:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-05-31 21:03 . 2010-05-31 21:03 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Help
2010-05-31 20:37 . 2010-05-31 20:37 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Labcenter Electronics
2010-05-31 16:21 . 2010-05-31 16:21 -------- d-----w- c:\program files\Common Files\Labcenter Electronics
2010-05-31 16:21 . 2005-10-18 15:36 54784 ----a-w- c:\windows\system32\INETWH32.DLL
2010-05-31 16:21 . 2005-10-18 15:36 1048576 ----a-w- c:\windows\system32\ROBOEX32.DLL
2010-05-31 16:21 . 2010-05-31 16:21 -------- d-----w- c:\program files\Labcenter Electronics
2010-05-29 20:27 . 2010-05-29 20:27 -------- d-----w- c:\documents and settings\Owner\Application Data\Octoshape
2010-05-22 14:18 . 2010-05-22 14:18 503808 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6760beae-n\msvcp71.dll
2010-05-22 14:18 . 2010-05-22 14:18 499712 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6760beae-n\jmc.dll
2010-05-22 14:18 . 2010-05-22 14:18 348160 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6760beae-n\msvcr71.dll
2010-05-22 14:18 . 2010-05-22 14:18 61440 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-6b353c29-n\decora-sse.dll
2010-05-22 14:18 . 2010-05-22 14:18 12800 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-6b353c29-n\decora-d3d.dll
2010-05-20 23:24 . 2010-05-20 23:24 1924976 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2010-05-20 14:34 . 2010-05-21 06:53 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-05-20 08:10 . 2010-05-20 08:10 -------- d-----w- c:\windows\system32\URTTEMP
2010-05-20 08:00 . 2003-07-01 16:47 9856 ------w- c:\windows\system32\drivers\pfc.sys
2010-05-20 08:00 . 2010-05-20 09:53 -------- d-----w- C:\pdwork
2010-05-13 11:20 . 2010-05-20 09:53 -------- d-----w- C:\Prezentacija
2010-05-13 02:49 . 2010-05-13 02:49 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\ABBYY
2010-05-13 02:49 . 2010-05-13 02:49 -------- d-----w- c:\documents and settings\Owner\Application Data\ABBYY
2010-05-13 02:48 . 2010-05-13 02:48 -------- d-----w- c:\documents and settings\All Users\Application Data\ABBYY
2010-05-13 02:47 . 2010-05-28 17:35 -------- d-----w- c:\program files\ABBYY FineReader 7.0 Professional Edition
2010-05-12 22:56 . 2010-05-12 22:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Macrovision
2010-05-12 22:56 . 2010-05-12 22:56 -------- d-----w- c:\program files\Common Files\Macromedia Shared
2010-05-12 22:55 . 2010-05-12 22:55 -------- d-----w- c:\program files\Common Files\Macromedia
2010-05-12 22:55 . 2010-05-12 22:55 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Macromedia
2010-05-12 22:55 . 2010-05-12 22:55 -------- d-----w- c:\program files\Macromedia
2010-05-06 21:41 . 2010-04-12 15:29 411368 ----a-w- c:\windows\system32\deployJava1.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-31 16:21 . 2009-05-20 17:19 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-05-29 16:01 . 2009-12-29 22:25 -------- d-----w- c:\program files\HTMLValidatorLite80
2010-05-28 17:36 . 2009-08-23 22:50 -------- d-----w- c:\program files\Sony
2010-05-22 19:39 . 2009-05-27 12:10 -------- d-----w- c:\program files\PokerStars
2010-05-20 08:30 . 2009-10-16 13:03 -------- d-----w- c:\documents and settings\Owner\Application Data\CyberLink
2010-05-20 08:05 . 2009-08-23 22:50 -------- d-----w- c:\program files\Sony Setup
2010-05-20 08:00 . 2009-05-21 07:18 -------- d-----w- c:\program files\CyberLink
2010-05-15 20:41 . 2009-08-13 19:12 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-12 22:55 . 2009-05-20 17:20 -------- d-----w- c:\program files\Common Files\InstallShield
2010-05-12 06:48 . 2009-08-20 07:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment
2010-05-10 21:54 . 2010-01-13 17:20 -------- d-----w- c:\program files\Garena
2010-05-06 21:41 . 2009-05-21 07:20 -------- d-----w- c:\program files\Java
2010-04-22 10:04 . 2010-04-22 10:04 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-04-21 15:38 . 2010-04-21 15:38 -------- d-----w- c:\documents and settings\Owner\Application Data\Media Player Classic
2010-04-21 13:59 . 2010-04-21 13:59 -------- d-----w- c:\program files\audio codec
2010-04-19 07:43 . 2010-04-19 07:43 -------- d-----w- c:\documents and settings\Owner\Application Data\Capcom
2010-04-16 18:00 . 2010-04-22 10:04 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-04-16 15:13 . 2010-04-16 15:13 -------- d-----w- c:\program files\WMV9_VCM
2010-04-13 19:37 . 2009-12-23 19:53 -------- d-----w- c:\program files\TeamSpeak 3 Client
2010-04-13 00:30 . 2010-04-13 00:29 -------- d-----w- c:\documents and settings\Owner\Application Data\fretsonfire
2010-04-06 15:24 . 2009-05-21 07:20 -------- d-----w- c:\program files\Common Files\Java
2010-04-04 15:01 . 2010-04-02 18:04 -------- d-----w- c:\documents and settings\Owner\Application Data\Skype
2010-04-04 14:55 . 2009-10-22 14:47 -------- d-----w- c:\documents and settings\Owner\Application Data\skypePM
2010-03-16 09:33 . 2010-04-21 13:44 52224 ----a-w- c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\hmpgpc5f.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\components\FFExternalAlert.dll
2010-03-16 09:33 . 2010-04-21 13:44 101376 ----a-w- c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\hmpgpc5f.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\components\RadioWMPCore.dll
.
------- Sigcheck -------
[-] 2008-01-25 . 9F960FAC5166F8626B9CDE4DD9A0EB84 . 1580544 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-04-24 203928]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2009-11-24 2923192]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="m‘|\ü" [X]
"RTHDCPL"="RTHDCPL.EXE" [2008-08-26 16851456]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-03-21 91432]
"GNConfig"="c:\program files\GIGABYTE\Gigabyte Super Wireless LAN Card\GNConfig.exe" [2008-06-19 393216]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-12-18 76304]
"Launch LGDCore"="c:\program files\Common Files\Logitech\G-series Software\LGDCore.exe" [2006-07-23 1126400]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2009-10-02 611712]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-11 13666408]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-01-11 110696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2010-03-30 1820040]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-7-24 809488]
Update Scheduler for Proteus Professional 7.lnk - c:\program files\Labcenter Electronics\Proteus 7 Professional\BIN\UDSCHED.EXE [2010-5-31 65564]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-02-18 22:30 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\dc\\StrongDC.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"d:\\Igre\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enGB-downloader.exe"=
"d:\\Igre\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"d:\\Igre\\World of Warcraft Public Test\\WoW-0.3.0.10522-enGB-ptr-downloader.exe"=
"d:\\Igre\\World of Warcraft Public Test\\WoW-0.3.0.10522-to-0.3.0.10554-enGB-ptr-downloader.exe"=
"d:\\Igre\\World of Warcraft Public Test\\Launcher.exe"=
"d:\\Igre\\World of Warcraft Public Test\\WoW-0.3.0.10554-to-0.3.0.10571-enGB-ptr-downloader.exe"=
"d:\\Igre\\World of Warcraft Public Test\\WoW-0.3.0.10571-to-0.3.0.10596-enGB-ptr-downloader.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"d:\\Program Files\\Zend\\ZendStudio-5.5.1\\jre\\bin\\javaw.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"59062:TCP"= 59062:TCP:Pando Media Booster
"59062:UDP"= 59062:UDP:Pando Media Booster
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [8.6.2009 15:12 721904]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\CyberLink\PowerDVD8\000.fcl [1.2.2008 17:24 41456]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [25.3.2010 11:37 135336]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [30.3.2010 11:16 1107336]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [24.1.2010 19:20 36608]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\Owner\LOCALS~1\Temp\XVF58.tmp --> c:\docume~1\Owner\LOCALS~1\Temp\XVF58.tmp [?]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{52c2952e-542e-11de-98db-c9024e0e163c}]
\Shell\AutoRun\command - g:\_autorun\AUTORUN.EXE
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Zend Studio - Debug current page - d:\program files\Zend\ZendStudio-5.5.1\bin\ZendIEToolbar.dll/DebugCurrent.html
IE: Zend Studio - Debug next page - d:\program files\Zend\ZendStudio-5.5.1\bin\ZendIEToolbar.dll/DebugNext.html
TCP: {C2CA7B52-48AE-4A2D-8C28-10E8AEDAE563} = 192.168.0.1
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\hmpgpc5f.default\
FF - component: c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\hmpgpc5f.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\hmpgpc5f.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\components\RadioWMPCore.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - ORPHANS REMOVED - - - -
URLSearchHooks-{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - c:\program files\Softonic-Eng7\tbSoft.dll
BHO-{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - c:\program files\Softonic-Eng7\tbSoft.dll
Toolbar-{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - c:\program files\Softonic-Eng7\tbSoft.dll
HKLM-Run-Launch LCDMon - c:\program files\Common Files\Logitech\LCD Manager\lcdmon.exe
HKLM-Run-nwiz - nwiz.exe
AddRemove-NVIDIA Display Control Panel - c:\program files\NVIDIA Corporation\Uninstall\nvuninst.exe
AddRemove-Softonic-Eng7 Toolbar - c:\progra~1\SOFTON~1\UNWISE.EXE
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-02 12:00
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A7081F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xb810cf10
\Driver\ACPI -> ACPI.sys @ 0xb7e66cb8
\Driver\atapi -> 0x8a7081f8
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80582544
ParseProcedure -> ntkrnlpa.exe @ 0x80581684
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80582544
ParseProcedure -> ntkrnlpa.exe @ 0x80581684
NDIS: Realtek RTL8168C(P)/8111C(P) PCI-E Gigabit Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xb7d04ba0
PacketIndicateHandler -> NDIS.sys @ 0xb7d11b21
SendHandler -> NDIS.sys @ 0xb7cef87b
Warning: possible MBR rootkit infection !
user & kernel MBR OK
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\Owner\LOCALS~1\Temp\XVF58.tmp"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(720)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
- - - - - - - > 'explorer.exe'(4016)
c:\program files\Logitech\SetPoint\GameHook.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\system32\msi.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\system32\acs.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-06-02 12:02:26 - machine was rebooted
ComboFix-quarantined-files.txt 2010-06-02 10:02
Pre-Run: 38.540.185.600 bytes free
Post-Run: 38.532.829.184 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
c:\wubildr.mbr="Ubuntu"
- - End Of File - - 3F59EC16B4E732861C4CBDDA7BBB8C0A