Sounds like a useful program
ComboFix 08-12-07.01 - Cris 2008-12-08 13:04:03.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1342 [GMT -8:00]
Running from: c:\users\Cris\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\temp\DIV55
c:\temp\DIV55\xDb.log
c:\temp\tn3
c:\users\Cris\AppData\Roaming\IUpd721
c:\users\Cris\AppData\Roaming\IUpd721\Logs\scns.log
c:\windows\system32\bin
c:\windows\system32\bxeebyksrvlaifiia.dll
c:\windows\system32\dv
c:\windows\system32\dv\BPI7C44.exe
c:\windows\system32\ki3
c:\windows\system32\TDSSdxdfilbj.dat
c:\windows\system32\uv9
c:\windows\system32\VC
c:\windows\Tasks\wvigwcbx.job
----- BITS: Possible infected sites -----
hxxp://childhe.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_TDSSSERV.SYS
-------\Service_TDSSserv.sys
((((((((((((((((((((((((( Files Created from 2008-11-08 to 2008-12-08 )))))))))))))))))))))))))))))))
.
2008-12-07 16:53 . 2008-12-07 16:53 <DIR> d-------- c:\users\Cris\AppData\Roaming\Malwarebytes
2008-12-07 16:53 . 2008-12-07 16:53 <DIR> d-------- c:\users\All Users\Malwarebytes
2008-12-07 16:53 . 2008-12-07 16:53 <DIR> d-------- c:\programdata\Malwarebytes
2008-12-07 16:53 . 2008-12-07 16:53 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-07 16:53 . 2008-12-03 19:52 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2008-12-07 16:53 . 2008-12-03 19:52 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2008-12-07 09:30 . 2008-12-07 09:30 <DIR> d-------- C:\rsit
2008-12-03 16:06 . 2008-12-03 16:06 <DIR> d-------- c:\program files\Trend Micro
2008-12-03 13:27 . 2008-12-08 13:04 <DIR> d-------- C:\Temp
2008-12-03 13:27 . 2008-12-03 13:49 47,598 --a------ c:\windows\System32\jvpjvecdjdzk.exe
2008-12-03 13:19 . 2008-12-03 13:49 2 --a------ C:\-1093278649
2008-12-02 22:10 . 2008-12-02 22:10 <DIR> d-------- c:\program files\Roleplaying City Map Generator
2008-11-25 11:07 . 2008-10-20 21:25 1,645,568 --a------ c:\windows\System32\connect.dll
2008-11-25 11:07 . 2008-08-27 19:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll
2008-11-25 11:07 . 2008-08-27 19:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll
2008-11-25 11:07 . 2008-08-27 19:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll
2008-11-25 11:07 . 2008-10-21 19:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll
2008-11-14 17:07 . 2008-11-14 17:07 <DIR> d-------- c:\program files\Real
2008-11-14 17:07 . 2008-11-14 17:07 <DIR> d-------- c:\program files\Common Files\xing shared
2008-11-14 17:07 . 2008-11-14 17:07 <DIR> d-------- c:\program files\Common Files\Real
2008-11-12 10:18 . 2008-09-09 19:40 1,334,272 --a------ c:\windows\System32\msxml6.dll
2008-11-12 10:18 . 2008-09-04 21:14 1,191,936 --a------ c:\windows\System32\msxml3.dll
2008-11-12 10:18 . 2008-08-26 17:05 212,480 --a------ c:\windows\System32\drivers\mrxsmb10.sys
2008-11-10 15:54 . 2008-11-19 21:57 <DIR> d-a------ c:\users\All Users\TEMP
2008-11-10 15:54 . 2008-11-19 21:57 <DIR> d-a------ c:\programdata\TEMP
2008-11-10 15:54 . 2008-11-19 21:26 <DIR> d-------- C:\Fraps
2008-11-09 13:54 . 2008-11-09 13:54 <DIR> d-------- c:\windows\Sun
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-08 21:09 --------- d-----w c:\program files\Steam
2008-12-05 00:52 --------- d-----w c:\programdata\Spybot - Search & Destroy
2008-12-03 21:56 --------- d-----w c:\program files\Common Files\Steam
2008-12-03 21:32 --------- d-----w c:\users\Cris\AppData\Roaming\foobar2000
2008-11-28 19:00 --------- d-----w c:\users\Cris\AppData\Roaming\OpenOffice.org2
2008-11-11 15:17 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-11-09 21:56 --------- d-----w c:\program files\SystemRequirementsLab
2008-11-09 21:55 --------- d-----w c:\users\Cris\AppData\Roaming\SystemRequirementsLab
2008-11-09 03:43 --------- d-----w c:\programdata\NVIDIA
2008-11-04 11:02 --------- d-----w c:\program files\Microsoft Works
2008-10-28 20:30 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-28 20:30 --------- d-----w c:\program files\Bethesda Softworks
2008-10-28 02:13 --------- d-----w c:\users\Cris\AppData\Roaming\FLV Extract
2008-10-27 23:08 --------- d-----w c:\programdata\Ironclad Games
2008-10-26 19:57 --------- d--h--w c:\programdata\{9ECEFAAC-75E3-4CC9-864C-D1071F1F0CDF}
2008-10-26 19:57 --------- d-----w c:\programdata\Stardock
2008-10-26 19:56 --------- d-----w c:\program files\Stardock Games
2008-10-25 20:06 --------- d-----w c:\users\Cris\AppData\Roaming\Stardock
2008-10-25 20:02 --------- dc-h--w c:\programdata\{C8EE221B-B5DA-4C2D-878A-57DAFBB8622E}
2008-10-25 20:02 --------- d-----w c:\program files\Stardock
2008-10-17 14:58 --------- d-----w c:\program files\Democracy2 Demo
2008-10-15 10:09 --------- d-----w c:\program files\Windows Mail
2008-10-12 20:39 --------- d-----w c:\program files\foobar2000
2008-10-08 23:32 --------- d-----w c:\users\Cris\AppData\Roaming\vlc
2008-09-15 21:50 174 --sha-w c:\program files\desktop.ini
2008-08-12 21:24 24 ----a-w c:\users\Cris\jagex_runescape_preferences.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2006-11-11 446976]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-18 1233920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-20 68856]
"Steam"="c:\program files\steam\steam.exe" [2008-10-08 1410296]
"ImpulseFastStart"="c:\program files\Stardock\Impulse\Impulse.exe" [2008-10-14 1717616]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-09-29 151552]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"CCUTRAYICON"="c:\program files\Intel\IntelDH\CCU\CCU_TrayIcon.exe" [2006-11-18 182744]
"NMSSupport"="c:\program files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" [2006-09-26 423424]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 115816]
"osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2006-12-05 22696]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2007-03-16 17920]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-05-25 1862144]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-09-17 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-17 8497696]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-09-17 81920]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-11-14 185872]
"SigmatelSysTrayApp"="sttray.exe" [2007-02-07 c:\windows\sttray.exe]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-03-18 113664]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-05-25 45056]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GOEC62~1.DLL,c:\windows\system32\parodupa.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders credssp.dll, digeste.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{EAA8B186-14F3-49C9-9525-6BBB377B9E48}"= UDP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{8F303A0E-9AFE-43C6-B476-E5BD6115A558}"= TCP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{40F7A7D2-B333-499C-86AA-5320620746E5}"= UDP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{0AFDDCC7-C1C8-4D67-84EB-8D4CA39BBF17}"= TCP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{62F371D7-0A43-4A58-B379-8DCA34744B24}"= UDP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{0998027B-BD7E-4632-BC7A-0B56482464CB}"= TCP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{CAE2EFD5-205D-44FE-B0B1-5ABAF771B8F3}"= TCP:Profile=Private|Profile=Public|9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
"{AB89EE7D-A5BB-4D37-A992-CA4D0A336177}"= TCP:Profile=Private|Profile=Public|1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
"TCP Query User{5A09396B-116B-49E2-A60D-6A2C754A216F}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{C757CED2-6AA3-4002-A604-1EEA64F5A545}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"{B6FF903D-B3E8-4947-B3DF-FC67279D5A52}"= UDP:c:\program files\LucasArts\Star Wars Empire at War\GameData\sweaw.exe:Star Wars: Empire at War
"{DFE1BF3E-7CA1-44C4-9C76-0CFA871774D8}"= TCP:c:\program files\LucasArts\Star Wars Empire at War\GameData\sweaw.exe:Star Wars: Empire at War
"{A48A2993-78DF-4588-8DED-D62D7E6BDC4A}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{23DB7C6E-A0DD-402C-B378-6B2C27CCFE2F}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{38838DDC-5981-48BA-A2AB-644D91FA5363}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{48996FC4-0F5A-4319-9E7D-389F318F37A2}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{6AF2403B-E8B6-4454-94B8-C2DB519F333C}"= UDP:c:\windows\System32\dlbkcoms.exe:AIO Printer A920 Server
"{1413D8D0-D391-46F8-8EEF-C5B050DB0ECC}"= TCP:c:\windows\System32\dlbkcoms.exe:AIO Printer A920 Server
"TCP Query User{2982FA6F-11EE-4042-B68C-80B731064704}c:\\program files\\turbine\\the lord of the rings online\\lotroclient.exe"= UDP:c:\program files\turbine\the lord of the rings online\lotroclient.exe:lotroclient.exe
"UDP Query User{507E8BF9-6B3E-4E9A-8434-869901C3D162}c:\\program files\\turbine\\the lord of the rings online\\lotroclient.exe"= TCP:c:\program files\turbine\the lord of the rings online\lotroclient.exe:lotroclient.exe
"TCP Query User{8FE9BA3B-51E6-4619-9ADB-B632D8AAE10F}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{35C39879-F515-4B7F-9DBC-BE392BA88608}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"{7D38E5C6-1829-4FC0-96AD-92B25786AF7C}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{238ED877-003B-442E-B4CE-21F0528BD1A6}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"TCP Query User{0016E537-AED3-45E7-8E58-86E80B908938}c:\\program files\\last.fm\\lastfm.exe"= UDP:c:\program files\last.fm\lastfm.exe:Last.fm
"UDP Query User{74D51921-D372-46DC-A889-B60C1EF527DE}c:\\program files\\last.fm\\lastfm.exe"= TCP:c:\program files\last.fm\lastfm.exe:Last.fm
"{D820CC63-9609-44BD-B1F9-9E68A7B8E150}"= UDP:c:\program files\BitTorrent_DNA\dna.exe:BitTorrent DNA
"{E92BBCDC-6C9D-47BE-A397-BF5350F42854}"= TCP:c:\program files\BitTorrent_DNA\dna.exe:BitTorrent DNA
"{8AC027DE-2E82-4F14-B668-08B5FBF80D44}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{AFD57EFB-CA89-4497-B60D-E55967CE274D}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"TCP Query User{A182450F-5C9E-410A-9D9B-88215DAD106A}c:\\neverwinternights\\nwn\\nwmain.exe"= UDP:c:\neverwinternights\nwn\nwmain.exe:Neverwinter Nights
"UDP Query User{C9BFF035-0F01-48CB-B2C8-138F30D73F08}c:\\neverwinternights\\nwn\\nwmain.exe"= TCP:c:\neverwinternights\nwn\nwmain.exe:Neverwinter Nights
"TCP Query User{E6686E3E-7EB4-4E31-89F2-AB051381F89A}c:\\program files\\steam\\steamapps\\ctillery\\team fortress 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\ctillery\team fortress 2\hl2.exe:hl2
"UDP Query User{970145B4-07BB-45D4-A9A0-5AF266CFD158}c:\\program files\\steam\\steamapps\\ctillery\\team fortress 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\ctillery\team fortress 2\hl2.exe:hl2
"{A5FB63F6-139D-4B3B-826D-2DC7FDCBA9B5}"= UDP:c:\program files\DNA\btdna.exe:DNA
"{4CDBC202-10FD-4608-8DF8-37187900CE80}"= TCP:c:\program files\DNA\btdna.exe:DNA
"{940E0D0F-ED56-4886-B29C-20C408AC4D66}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{D8220FD7-0A3E-40C7-89D0-1FFD4F8DD205}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{93A9DA53-6DD3-47A3-BC6A-D60A4BD2B2C5}c:\\program files\\steam\\steamapps\\ctillery\\half-life 2 deathmatch\\hl2.exe"= UDP:c:\program files\steam\steamapps\ctillery\half-life 2 deathmatch\hl2.exe:hl2
"UDP Query User{AB2F13D9-016D-4DCA-AD32-13A83095DAE7}c:\\program files\\steam\\steamapps\\ctillery\\half-life 2 deathmatch\\hl2.exe"= TCP:c:\program files\steam\steamapps\ctillery\half-life 2 deathmatch\hl2.exe:hl2
"TCP Query User{480FE579-262A-4795-A099-0CB32ABFC4AC}c:\\program files\\turbine\\the lord of the rings online\\lotroclient.exe"= UDP:c:\program files\turbine\the lord of the rings online\lotroclient.exe:lotroclient
"UDP Query User{1ABDA973-064F-46DF-8CF8-4DE81687354A}c:\\program files\\turbine\\the lord of the rings online\\lotroclient.exe"= TCP:c:\program files\turbine\the lord of the rings online\lotroclient.exe:lotroclient
"TCP Query User{219C7EC4-45F9-4C46-94D0-B78A214B5DD8}c:\\program files\\steam\\steamapps\\ctillery\\team fortress 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\ctillery\team fortress 2\hl2.exe:hl2
"UDP Query User{923DA9A3-6772-47B8-96B5-ACFA204A643D}c:\\program files\\steam\\steamapps\\ctillery\\team fortress 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\ctillery\team fortress 2\hl2.exe:hl2
"TCP Query User{B65F92B3-6B1C-41D5-8B58-825385561E90}c:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= UDP:c:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"UDP Query User{1C6BD907-D75E-40BA-9DCD-6C06A3AFE679}c:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= TCP:c:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"TCP Query User{A547F004-2E5A-4DFF-B225-78B263866CC6}c:\\program files\\yahoo!\\messenger\\yserver.exe"= UDP:c:\program files\yahoo!\messenger\yserver.exe:YServer Module
"UDP Query User{D22F0915-F782-4B57-9F91-0F464BAFA6EF}c:\\program files\\yahoo!\\messenger\\yserver.exe"= TCP:c:\program files\yahoo!\messenger\yserver.exe:YServer Module
"TCP Query User{B2CA3DE2-E12B-4965-9456-FCDCF7E94828}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{69669BAB-095C-4575-B3DD-3B2CD2756DE8}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"{1486C307-4711-4C19-B443-9617ABB88756}"= UDP:c:\program files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)
"{88E0A49B-184E-4F00-8550-A84BD67990DE}"= TCP:c:\program files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)
"{C482DC3A-50A2-4E2F-9198-36489DD14AFB}"= UDP:c:\program files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)
"{E3816F67-BC2E-4ADB-93AF-5C4FC319E6AF}"= TCP:c:\program files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)
"TCP Query User{97E8B0E4-8711-4C8B-9B1F-BC3DA87734D4}c:\\program files\\steam\\steamapps\\common\\dawn of war demo\\w40k.exe"= UDP:c:\program files\steam\steamapps\common\dawn of war demo\w40k.exe:W40K
"UDP Query User{DD913A0E-1738-469B-BDD3-A76C6017FAB7}c:\\program files\\steam\\steamapps\\common\\dawn of war demo\\w40k.exe"= TCP:c:\program files\steam\steamapps\common\dawn of war demo\w40k.exe:W40K
"TCP Query User{0610D84C-7DE4-45DD-80DC-9F46FBE92172}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{9CCB3CF2-0B21-4A99-B999-91681FE93EE5}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent
"{5322ECF5-FB63-4244-A8B5-078433E371BA}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Gold\Civilization4.exe:Sid Meier's Civilization 4 Gold
"{C905E453-7AFA-4DFB-9A41-C7BA583674F4}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Gold\Civilization4.exe:Sid Meier's Civilization 4 Gold
"{1458C6D7-08CA-4632-8573-57D90F20BFAB}"= UDP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Gold\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords
"{F385D8F5-DD61-4B26-AF2F-E14F043749FD}"= TCP:c:\program files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Gold\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords
"TCP Query User{D54349A9-189F-4BB5-8948-551435D0A01E}c:\\program files\\gametap\\bin\\release\\gametap.exe"= UDP:c:\program files\gametap\bin\release\gametap.exe:GameTap Application
"UDP Query User{A740E1B4-8A71-437C-A712-079D2139838B}c:\\program files\\gametap\\bin\\release\\gametap.exe"= TCP:c:\program files\gametap\bin\release\gametap.exe:GameTap Application
"TCP Query User{82C6A510-98CF-42BA-8241-CE9C4FBD360A}c:\\program files\\electronic arts\\eadm\\core.exe"= UDP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
"UDP Query User{78A45E52-E14D-492E-BE2E-2CA061D026CB}c:\\program files\\electronic arts\\eadm\\core.exe"= TCP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager
"{547D0104-8C48-4B02-A952-DEDB84801AD4}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{E019CDFC-BEA6-4093-B718-6EA6E8A8FD4A}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{E1E45325-CEDD-42E8-970D-EA697C6AC663}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{D3583625-6727-426E-AF52-8601B7CB6422}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{2432E36B-2F4A-46A0-98D1-8A830D66A4B4}"= UDP:c:\program files\Stardock Games\The Political Machine 2008 Express\PolMachine2008Express.exe:The Political Machine 2008
"{D0491E05-F64B-42D9-89B0-FEDB262EDC17}"= TCP:c:\program files\Stardock Games\The Political Machine 2008 Express\PolMachine2008Express.exe:The Political Machine 2008
"{287244ED-A2A7-4A21-967B-AF270964E760}"= UDP:c:\program files\Stardock Games\Sins of a Solar Empire\Sins of a Solar Empire.exe:Sins of a Solar Empire
"{A79709EA-CC04-4A8C-BC9C-1577690C8D81}"= TCP:c:\program files\Stardock Games\Sins of a Solar Empire\Sins of a Solar Empire.exe:Sins of a Solar Empire
"TCP Query User{C029C746-698E-4EA0-AD5A-FD4BC7A6C9B8}c:\\program files\\real\\realplayer\\realplay.exe"= UDP:c:\program files\real\realplayer\realplay.exe:RealPlayer
"UDP Query User{08B8F9BA-2FC1-490F-BA04-FD04D9DFA88C}c:\\program files\\real\\realplayer\\realplay.exe"= TCP:c:\program files\real\realplayer\realplay.exe:RealPlayer
"{FD5DDD98-8DA6-40BE-BBB3-1F23AB9549FA}"= UDP:c:\windows\System32\VSSVC.exe:vssvc
"{4532A3EE-E748-4E23-9E78-2E3C510D74C1}"= TCP:c:\windows\System32\VSSVC.exe:vssvc
"{DD402CE2-4BAC-4AFB-8EEE-C9A16A6B7067}"= UDP:c:\windows\System32\SearchProtocolHost.exe:SearchProtocolHost
"{46FAAF6D-1368-4D75-B870-D26985DE3A06}"= TCP:c:\windows\System32\SearchProtocolHost.exe:SearchProtocolHost
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
R1 IDSvix86;Symantec Intrusion Prevention Driver;\??\c:\progra~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys [2007-05-25 202872]
R2 dlbk_device;dlbk_device;c:\windows\system32\dlbkcoms.exe -service []
R2 DQLWinService;DQLWinService;"c:\program files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe" [2006-10-29 208896]
R2 nmsgopro;GoProto Protocol Driver for NMS;c:\windows\system32\DRIVERS\nmsgopro.sys [2006-09-27 28672]
R2 nmsunidr;UniDriver for NMS;c:\windows\system32\DRIVERS\nmsunidr.sys [2006-10-19 7424]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2007-05-31 106808]
R3 IntelDH;IntelDH Driver;c:\windows\system32\Drivers\IntelDH.sys [2007-05-25 5504]
R3 SYMNDISV;SYMNDISV;c:\windows\system32\Drivers\SYMNDISV.SYS [2006-12-05 37008]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b379c06d-0ab4-11dc-89fc-806e6f6e6963}]
\shell\AutoRun\command - F:\FalloutLauncher.exe
*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
2008-12-02 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - Cris.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2006-12-05 19:51]
2008-12-08 c:\windows\Tasks\User_Feed_Synchronization-{938F6F14-F77A-4452-A209-37D9C3CB0DD3}.job
- c:\windows\system32\msfeedssync.exe [2008-01-18 23:33]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-Vidalia - c:\program files\Vidalia Bundle\Vidalia\vidalia.exe
HKLM-Run-Dell AIO Printer A920 - c:\program files\Dell AIO Printer A920\dlbkbmgr.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=0070525
uInternet Settings,ProxyOverride = *.local
FireFox -: Profile - c:\users\Cris\AppData\Roaming\Mozilla\Firefox\Profiles\94eyykzz.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.cnn.com
FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\program files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - c:\program files\DNA\plugins\npbtdna.dll
FF -: plugin - c:\program files\GameTap\bin\Release\npgametaptool.dll
FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava11.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava12.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava13.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava14.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava32.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjpi160.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npoji610.dll
FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-08 13:09:18
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'Explorer.exe'(3252)
c:\program files\Roxio\Drag-to-Disc\Shellex.dll
c:\windows\system32\DLAAPI_W.DLL
c:\program files\Roxio\Drag-to-Disc\ShellRes.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\rundll32.exe
c:\program files\Common Files\Symantec Shared\ccSvcHst.exe
c:\program files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\System32\rundll32.exe
c:\program files\Intel\IntelDH\CCU\CCU_Engine.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\System32\dlbkcoms.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
c:\windows\System32\drivers\XAudio.exe
c:\program files\Intel\IntelDH\CCU\AlertService.exe
c:\windows\System32\wbem\WMIADAP.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2008-12-08 13:18:08 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-08 21:17:26
Pre-Run: 73,446,469,632 bytes free
Post-Run: 73,254,592,512 bytes free
312 --- E O F --- 2008-12-02 01:52:56