woodyz
2008-01-02, 01:48
I have reviewed other issues of this in the forums and I have created the hijack this log and have run the combo fix here are both logs. What I need to know is what other files do I need to delete
Heres the combo fix log
ComboFix 07-12-31.4 - Jamie 2008-01-01 18:10:09.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.832 [GMT -5:00]
Running from: C:\Documents and Settings\Jamie\Desktop\internet tools\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\findfast.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\autorun.exe
C:\Documents and Settings\Jamie\Application Data\printer.exe
C:\Documents and Settings\Jamie\Start Menu\Programs\Startup\findfast.exe
C:\Program Files\Dell\QuickSet\quickset .exe
C:\Program Files\Dell\QuickSet\quickset .exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Helper
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\temp\tn3
C:\WINDOWS\lsass .exe
C:\WINDOWS\mrofinu572.exe
C:\WINDOWS\shell.exe
C:\WINDOWS\system32\ddcyx.dll
C:\WINDOWS\system32\ddcyx.exe
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\printer.exe
C:\WINDOWS\system32\sks~1
C:\WINDOWS\system32\wowfx.dll
C:\WINDOWS\system32\xycdd.ini
C:\WINDOWS\system32\xycdd.ini2
C:\WINDOWS\system32\z1
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_CMDSERVICE
-------\LEGACY_CORE
-------\LEGACY_NETWORK_MONITOR
-------\cmdService
((((((((((((((((((((((((( Files Created from 2007-12-01 to 2008-01-01 )))))))))))))))))))))))))))))))
.
2008-01-01 18:05 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-01 16:25 . 2008-01-01 16:25 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2007-12-31 23:16 . 2007-12-31 23:16 <DIR> d-------- C:\Documents and Settings\Jamie\Application Data\Grisoft
2007-12-31 23:16 . 2007-05-30 07:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-12-31 23:15 . 2007-12-31 23:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-31 21:04 . 2008-01-01 00:56 9,728 --a------ C:\WINDOWS\system32\printer .exe
2007-12-31 20:56 . 2005-01-28 19:11 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Sonic
2007-12-31 20:56 . 2005-01-28 19:04 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc
2007-12-31 20:42 . 2008-01-01 18:28 3,666 --a------ C:\WINDOWS\system32\Config.MPF
2007-12-31 20:38 . 2006-03-03 11:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll
2007-12-31 20:28 . 2007-06-25 10:57 37,480 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys
2007-12-31 20:28 . 2007-06-25 10:57 34,184 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2007-12-31 20:28 . 2007-06-25 10:57 32,008 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys
2007-12-31 20:27 . 2007-06-25 10:57 171,240 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2007-12-31 20:27 . 2007-03-02 14:16 109,608 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys
2007-12-31 20:27 . 2007-06-25 14:54 71,496 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2007-12-31 20:22 . 2007-12-31 20:24 <DIR> d-------- C:\Program Files\McAfee.com
2007-12-31 20:22 . 2007-12-31 20:37 <DIR> d-------- C:\Program Files\Common Files\McAfee
2007-12-31 20:21 . 2007-12-31 20:46 <DIR> d-------- C:\Program Files\McAfee
2007-12-31 20:11 . 2007-12-31 20:58 9,728 --a------ C:\WINDOWS\shell .exe
2007-12-31 20:10 . 2007-12-31 20:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2007-12-31 18:35 . 2007-12-31 22:51 3,000 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-30 21:27 . 2007-12-31 23:02 155,648 --a------ C:\WINDOWS\system32\igfxtray .exe
2007-12-30 21:27 . 2007-12-31 23:02 126,976 --a------ C:\WINDOWS\system32\hkcmd .exe
2007-12-30 21:10 . 2007-12-31 21:04 15,360 --a------ C:\WINDOWS\system32\ctfmon .exe
2007-12-30 21:06 . 2007-12-30 21:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-30 20:28 . 2007-12-31 22:23 <DIR> d-------- C:\WINDOWS\system32\mr9
2007-12-30 20:28 . 2007-12-30 21:02 <DIR> d-------- C:\WINDOWS\system32\ardCo01
2007-12-30 20:28 . 2008-01-01 16:01 <DIR> d-------- C:\WINDOWS\system32\aj2
2007-12-30 20:28 . 2007-12-31 22:36 <DIR> d--hs---- C:\WINDOWS\SmFtaWU
2007-12-30 20:28 . 2007-12-30 20:28 <DIR> d-------- C:\Temp\cEeer12
2007-12-30 20:28 . 2008-01-01 18:21 <DIR> d-------- C:\Temp
2007-12-30 19:48 . 2007-12-30 19:48 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-30 19:48 . 2007-12-30 19:48 1,409 --a------ C:\WINDOWS\QTFont.for
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-01 21:47 --------- d-----w C:\Program Files\eGames
2008-01-01 21:45 --------- d-----w C:\Program Files\Google
2008-01-01 04:03 --------- d-----w C:\Program Files\QuickTime
2008-01-01 04:02 --------- d-----w C:\Program Files\DellSupport
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-07-28 09:06 135 ----a-w C:\Program Files\page.html
2006-11-25 07:57 482 ----a-w C:\Program Files\Del.js
.
----a-w 9,728 2008-01-01 01:52:31 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\autorun .exe
----a-w 9,728 2007-12-31 04:09:07 C:\Documents and Settings\Jamie\Desktop\internet tools\backups\backup-20071230-232207-701-findfast .exe
----a-w 221,184 2008-01-01 04:03:30 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM .exe
----a-w 110,592 2008-01-01 04:03:29 C:\Program Files\Common Files\Sonic\Update Manager\sgtray .exe
----a-w 53,248 2008-01-01 04:03:27 C:\Program Files\CyberLink\PowerDVD\DVDLauncher .exe
----a-w 460,784 2008-01-01 04:03:44 C:\Program Files\DellSupport\DSAgnt .exe
----a-w 68,856 2008-01-01 04:04:05 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
----a-w 86,016 2008-01-01 04:03:26 C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr .exe
----a-w 32,881 2008-01-01 04:03:18 C:\Program Files\Java\j2re1.4.2_03\bin\jusched .exe
----a-w 524,288 2008-01-01 04:04:21 C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree .exe
----a-w 98,304 2008-01-01 02:04:26 C:\Program Files\QuickTime\qttask .exe
----a-w 98,304 2008-01-01 04:03:32 C:\Program Files\QuickTime\qttask .exe
----a-w 1,460,560 2008-01-01 04:04:15 C:\Program Files\Spybot - Search & Destroy\TeaTimer .exe
----a-w 536,576 2008-01-01 04:03:23 C:\Program Files\Synaptics\SynTP\SynTPEnh .exe
----a-w 98,304 2008-01-01 04:03:21 C:\Program Files\Synaptics\SynTP\SynTPLpr .exe
----a-w 9,728 2008-01-01 01:58:59 C:\WINDOWS\shell .exe
----a-w 15,360 2008-01-01 02:04:48 C:\WINDOWS\system32\ctfmon .exe
----a-w 126,976 2008-01-01 04:02:59 C:\WINDOWS\system32\hkcmd .exe
----a-w 155,648 2008-01-01 04:02:53 C:\WINDOWS\system32\igfxtray .exe
----a-w 9,728 2008-01-01 05:56:09 C:\WINDOWS\system32\printer .exe
----a-w 127,035 2008-01-01 04:03:28 C:\WINDOWS\system32\dla\tfswctrl .exe
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{108A645F-19F4-4BC5-AA4C-6825861FF64D}]
C:\WINDOWS\system32\ddcyx.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4C2F1620-DB74-49DD-9D2B-424E7C949EB4}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{50690DFA-3BE1-4EB2-AA5C-7DB277FA78D4}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EC1293A2-FFE1-48F6-A2DB-3B9C433669B8}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [ ]
"Spoolsv"="C:\WINDOWS\system32\spoolvs.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [ ]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [ ]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [ ]
"PRONoMgrWired"="C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe" [ ]
"lsass"="C:\WINDOWS\lsass .exe" [ ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [ ]
"Printer"="C:\WINDOWS\system32\printer.exe" [ ]
"combofix"="C:\WINDOWS\system32\cmd.exe" [2004-08-04 06:00 388608]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
C:\Documents and Settings\Jamie\Start Menu\Programs\Startup\
findfast.exe [2005-05-01 22:39:42]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
autorun .exe [2007-12-31 20:52:31]
autorun.exe [2005-05-01 22:39:42]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-01-28 18:58:09]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 1 (0x1)
"DisableTaskMgr"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoControlPanel"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Shell"="Explorer.exe C:\\WINDOWS\\shell.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqpopp]
ssqpopp.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, wowfx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jamie^Start Menu^Programs^Startup^findfast .exe]
path=C:\Documents and Settings\Jamie\Start Menu\Programs\Startup\findfast .exe
backup=C:\WINDOWS\pss\findfast .exeStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\WINDOWS\system32\ddcyx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
2004-09-14 09:50 53248 --a------ C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
2004-09-14 09:50 131072 --a------ C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PopUpStopperFreeEdition]
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spoolsv]
C:\WINDOWS\system32\spoolvs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-01-01 01:25:22 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-01-01 06:01:06 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************
catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-01 18:29:47
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-01 18:33:07 - machine was rebooted
C:\qoobox\ComboFix-quarantined-files.txt 2008-01-01 23:32:55
.
2007-12-14 03:38:08 --- E O F ---
Heres the combo fix log
ComboFix 07-12-31.4 - Jamie 2008-01-01 18:10:09.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.832 [GMT -5:00]
Running from: C:\Documents and Settings\Jamie\Desktop\internet tools\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\findfast.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\autorun.exe
C:\Documents and Settings\Jamie\Application Data\printer.exe
C:\Documents and Settings\Jamie\Start Menu\Programs\Startup\findfast.exe
C:\Program Files\Dell\QuickSet\quickset .exe
C:\Program Files\Dell\QuickSet\quickset .exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Helper
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\temp\tn3
C:\WINDOWS\lsass .exe
C:\WINDOWS\mrofinu572.exe
C:\WINDOWS\shell.exe
C:\WINDOWS\system32\ddcyx.dll
C:\WINDOWS\system32\ddcyx.exe
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\printer.exe
C:\WINDOWS\system32\sks~1
C:\WINDOWS\system32\wowfx.dll
C:\WINDOWS\system32\xycdd.ini
C:\WINDOWS\system32\xycdd.ini2
C:\WINDOWS\system32\z1
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_CMDSERVICE
-------\LEGACY_CORE
-------\LEGACY_NETWORK_MONITOR
-------\cmdService
((((((((((((((((((((((((( Files Created from 2007-12-01 to 2008-01-01 )))))))))))))))))))))))))))))))
.
2008-01-01 18:05 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-01 16:25 . 2008-01-01 16:25 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2007-12-31 23:16 . 2007-12-31 23:16 <DIR> d-------- C:\Documents and Settings\Jamie\Application Data\Grisoft
2007-12-31 23:16 . 2007-05-30 07:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-12-31 23:15 . 2007-12-31 23:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-31 21:04 . 2008-01-01 00:56 9,728 --a------ C:\WINDOWS\system32\printer .exe
2007-12-31 20:56 . 2005-01-28 19:11 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Sonic
2007-12-31 20:56 . 2005-01-28 19:04 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc
2007-12-31 20:42 . 2008-01-01 18:28 3,666 --a------ C:\WINDOWS\system32\Config.MPF
2007-12-31 20:38 . 2006-03-03 11:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll
2007-12-31 20:28 . 2007-06-25 10:57 37,480 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys
2007-12-31 20:28 . 2007-06-25 10:57 34,184 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2007-12-31 20:28 . 2007-06-25 10:57 32,008 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys
2007-12-31 20:27 . 2007-06-25 10:57 171,240 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2007-12-31 20:27 . 2007-03-02 14:16 109,608 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys
2007-12-31 20:27 . 2007-06-25 14:54 71,496 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2007-12-31 20:22 . 2007-12-31 20:24 <DIR> d-------- C:\Program Files\McAfee.com
2007-12-31 20:22 . 2007-12-31 20:37 <DIR> d-------- C:\Program Files\Common Files\McAfee
2007-12-31 20:21 . 2007-12-31 20:46 <DIR> d-------- C:\Program Files\McAfee
2007-12-31 20:11 . 2007-12-31 20:58 9,728 --a------ C:\WINDOWS\shell .exe
2007-12-31 20:10 . 2007-12-31 20:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2007-12-31 18:35 . 2007-12-31 22:51 3,000 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-30 21:27 . 2007-12-31 23:02 155,648 --a------ C:\WINDOWS\system32\igfxtray .exe
2007-12-30 21:27 . 2007-12-31 23:02 126,976 --a------ C:\WINDOWS\system32\hkcmd .exe
2007-12-30 21:10 . 2007-12-31 21:04 15,360 --a------ C:\WINDOWS\system32\ctfmon .exe
2007-12-30 21:06 . 2007-12-30 21:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-30 20:28 . 2007-12-31 22:23 <DIR> d-------- C:\WINDOWS\system32\mr9
2007-12-30 20:28 . 2007-12-30 21:02 <DIR> d-------- C:\WINDOWS\system32\ardCo01
2007-12-30 20:28 . 2008-01-01 16:01 <DIR> d-------- C:\WINDOWS\system32\aj2
2007-12-30 20:28 . 2007-12-31 22:36 <DIR> d--hs---- C:\WINDOWS\SmFtaWU
2007-12-30 20:28 . 2007-12-30 20:28 <DIR> d-------- C:\Temp\cEeer12
2007-12-30 20:28 . 2008-01-01 18:21 <DIR> d-------- C:\Temp
2007-12-30 19:48 . 2007-12-30 19:48 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-30 19:48 . 2007-12-30 19:48 1,409 --a------ C:\WINDOWS\QTFont.for
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-01 21:47 --------- d-----w C:\Program Files\eGames
2008-01-01 21:45 --------- d-----w C:\Program Files\Google
2008-01-01 04:03 --------- d-----w C:\Program Files\QuickTime
2008-01-01 04:02 --------- d-----w C:\Program Files\DellSupport
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-07-28 09:06 135 ----a-w C:\Program Files\page.html
2006-11-25 07:57 482 ----a-w C:\Program Files\Del.js
.
----a-w 9,728 2008-01-01 01:52:31 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\autorun .exe
----a-w 9,728 2007-12-31 04:09:07 C:\Documents and Settings\Jamie\Desktop\internet tools\backups\backup-20071230-232207-701-findfast .exe
----a-w 221,184 2008-01-01 04:03:30 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM .exe
----a-w 110,592 2008-01-01 04:03:29 C:\Program Files\Common Files\Sonic\Update Manager\sgtray .exe
----a-w 53,248 2008-01-01 04:03:27 C:\Program Files\CyberLink\PowerDVD\DVDLauncher .exe
----a-w 460,784 2008-01-01 04:03:44 C:\Program Files\DellSupport\DSAgnt .exe
----a-w 68,856 2008-01-01 04:04:05 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
----a-w 86,016 2008-01-01 04:03:26 C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr .exe
----a-w 32,881 2008-01-01 04:03:18 C:\Program Files\Java\j2re1.4.2_03\bin\jusched .exe
----a-w 524,288 2008-01-01 04:04:21 C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree .exe
----a-w 98,304 2008-01-01 02:04:26 C:\Program Files\QuickTime\qttask .exe
----a-w 98,304 2008-01-01 04:03:32 C:\Program Files\QuickTime\qttask .exe
----a-w 1,460,560 2008-01-01 04:04:15 C:\Program Files\Spybot - Search & Destroy\TeaTimer .exe
----a-w 536,576 2008-01-01 04:03:23 C:\Program Files\Synaptics\SynTP\SynTPEnh .exe
----a-w 98,304 2008-01-01 04:03:21 C:\Program Files\Synaptics\SynTP\SynTPLpr .exe
----a-w 9,728 2008-01-01 01:58:59 C:\WINDOWS\shell .exe
----a-w 15,360 2008-01-01 02:04:48 C:\WINDOWS\system32\ctfmon .exe
----a-w 126,976 2008-01-01 04:02:59 C:\WINDOWS\system32\hkcmd .exe
----a-w 155,648 2008-01-01 04:02:53 C:\WINDOWS\system32\igfxtray .exe
----a-w 9,728 2008-01-01 05:56:09 C:\WINDOWS\system32\printer .exe
----a-w 127,035 2008-01-01 04:03:28 C:\WINDOWS\system32\dla\tfswctrl .exe
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{108A645F-19F4-4BC5-AA4C-6825861FF64D}]
C:\WINDOWS\system32\ddcyx.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4C2F1620-DB74-49DD-9D2B-424E7C949EB4}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{50690DFA-3BE1-4EB2-AA5C-7DB277FA78D4}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EC1293A2-FFE1-48F6-A2DB-3B9C433669B8}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [ ]
"Spoolsv"="C:\WINDOWS\system32\spoolvs.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [ ]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [ ]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [ ]
"PRONoMgrWired"="C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe" [ ]
"lsass"="C:\WINDOWS\lsass .exe" [ ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [ ]
"Printer"="C:\WINDOWS\system32\printer.exe" [ ]
"combofix"="C:\WINDOWS\system32\cmd.exe" [2004-08-04 06:00 388608]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
C:\Documents and Settings\Jamie\Start Menu\Programs\Startup\
findfast.exe [2005-05-01 22:39:42]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
autorun .exe [2007-12-31 20:52:31]
autorun.exe [2005-05-01 22:39:42]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-01-28 18:58:09]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 1 (0x1)
"DisableTaskMgr"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoControlPanel"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Shell"="Explorer.exe C:\\WINDOWS\\shell.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqpopp]
ssqpopp.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, wowfx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jamie^Start Menu^Programs^Startup^findfast .exe]
path=C:\Documents and Settings\Jamie\Start Menu\Programs\Startup\findfast .exe
backup=C:\WINDOWS\pss\findfast .exeStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\WINDOWS\system32\ddcyx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
2004-09-14 09:50 53248 --a------ C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
2004-09-14 09:50 131072 --a------ C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PopUpStopperFreeEdition]
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spoolsv]
C:\WINDOWS\system32\spoolvs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-01-01 01:25:22 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-01-01 06:01:06 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************
catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-01 18:29:47
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-01 18:33:07 - machine was rebooted
C:\qoobox\ComboFix-quarantined-files.txt 2008-01-01 23:32:55
.
2007-12-14 03:38:08 --- E O F ---