Infected by wintems.exe & hldrrr.exe [Archive]

sotong

2008-03-31, 14:49

Hi, my PC has been infected by above virus/malware.

Used ComboFix utility & deleted these nasty files.

However, I find that my AVG antivirus software is still not working so I'll reinstall it.

I need to know if my PC is clean and safe. Please review. Thank you.

ComboFix 08-03-30.3 - Anthony 2008-03-31 21:56:59.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.674 [GMT 11:00]
Running from: J:\Files to remove wintems virus\Combo-Fix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
TimedOut: progfile.dat

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Anthony\Application Data\inst.exe
C:\WINDOWS\system32\drivers\down
C:\WINDOWS\system32\drivers\down\1017546.exe
C:\WINDOWS\system32\drivers\down\1029765.exe
C:\WINDOWS\system32\drivers\down\1045031.exe
C:\WINDOWS\system32\drivers\down\1055125.exe
C:\WINDOWS\system32\drivers\down\1087593.exe
C:\WINDOWS\system32\drivers\down\1099328.exe
C:\WINDOWS\system32\drivers\down\1108046.exe
C:\WINDOWS\system32\drivers\down\1112843.exe
C:\WINDOWS\system32\drivers\down\1126718.exe
C:\WINDOWS\system32\drivers\down\1155859.exe
C:\WINDOWS\system32\drivers\down\1197500.exe
C:\WINDOWS\system32\drivers\down\1209015.exe
C:\WINDOWS\system32\drivers\down\1218750.exe
C:\WINDOWS\system32\drivers\down\3599765.exe
C:\WINDOWS\system32\drivers\down\3613593.exe
C:\WINDOWS\system32\drivers\down\3619125.exe
C:\WINDOWS\system32\drivers\down\3639640.exe
C:\WINDOWS\system32\drivers\down\3695453.exe
C:\WINDOWS\system32\drivers\down\3704781.exe
C:\WINDOWS\system32\drivers\down\3724718.exe
C:\WINDOWS\system32\drivers\down\3735953.exe
C:\WINDOWS\system32\drivers\down\3746671.exe
C:\WINDOWS\system32\drivers\down\3762640.exe
C:\WINDOWS\system32\drivers\down\3787796.exe
C:\WINDOWS\system32\drivers\down\3799453.exe
C:\WINDOWS\system32\drivers\down\3806312.exe
C:\WINDOWS\system32\drivers\down\3809468.exe
C:\WINDOWS\system32\drivers\down\3822578.exe
C:\WINDOWS\system32\drivers\down\3851359.exe
C:\WINDOWS\system32\drivers\down\3890843.exe
C:\WINDOWS\system32\drivers\down\3903140.exe
C:\WINDOWS\system32\drivers\down\3909390.exe
C:\WINDOWS\system32\drivers\down\853125.exe
C:\WINDOWS\system32\drivers\down\858343.exe
C:\WINDOWS\system32\drivers\down\905171.exe
C:\WINDOWS\system32\drivers\down\913890.exe
C:\WINDOWS\system32\drivers\down\923656.exe
C:\WINDOWS\system32\drivers\down\937531.exe
C:\WINDOWS\system32\drivers\down\986593.exe
C:\WINDOWS\system32\drivers\down\996875.exe
C:\WINDOWS\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\mdelk.exe
C:\WINDOWS\system32\wintems.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SROSA

((((((((((((((((((((((((( Files Created from 2008-02-28 to 2008-03-31 )))))))))))))))))))))))))))))))
.

2008-03-28 21:45 . 2008-03-28 21:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\EscapeTheMuseum
2008-03-28 13:02 . 2008-03-28 13:02 <DIR> d-------- C:\Documents and Settings\Anthony\Application Data\softvibe
2008-03-21 16:50 . 2008-03-21 16:50 <DIR> d-------- C:\Documents and Settings\Anthony\Application Data\PlayFirst
2008-03-19 09:09 . 2008-03-19 09:17 <DIR> d-------- C:\Program Files\VitalDesktop
2008-03-18 14:34 . 2006-03-01 05:21 1,263,616 --a------ C:\WINDOWS\system32\Aurora Vista.scr
2008-03-18 14:34 . 2006-03-01 05:21 117,248 --a------ C:\WINDOWS\system32\Ribbons Vista.scr
2008-03-18 14:34 . 2006-03-03 14:42 117,248 --a------ C:\WINDOWS\system32\Mystify Vista.scr
2008-03-18 14:23 . 2006-03-01 04:53 773,120 --a------ C:\WINDOWS\system32\Bubbles Vista.scr
2008-03-17 21:01 . 2008-03-17 21:01 <DIR> d-------- C:\Documents and Settings\Anthony\Application Data\cerasus.media
2008-03-15 23:36 . 2008-03-15 23:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kayo Games
2008-03-13 17:30 . 2008-03-13 17:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Go Go Gourmet
2008-03-13 17:28 . 2008-03-13 17:28 356,352 --a------ C:\WINDOWS\eSellerateEngine.dll
2008-03-11 08:38 . 2008-03-13 17:28 1,720,111 --a------ C:\WINDOWS\hctpro43.exe
2008-02-28 18:17 . 2008-02-28 18:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MonteCristo
2008-02-25 12:43 . 2006-12-04 10:03 77,824 --------- C:\WINDOWS\system32\KmRemove.exe
2008-02-25 12:43 . 2006-06-14 18:06 7,952 --a------ C:\WINDOWS\system32\drivers\Maestro1.sys
2008-02-23 12:17 . 2008-02-23 12:17 <DIR> d-------- C:\Program Files\Realtek AC97
2008-02-23 10:45 . 2008-02-25 12:43 <DIR> d-------- C:\Program Files\KMaestro
2008-02-23 00:41 . 2008-02-23 12:17 <DIR> d-------- C:\Program Files\Realtek AC97(2)
2008-02-18 18:11 . 2008-02-18 18:11 <DIR> d-------- C:\Program Files\Common Files\SWF Studio
2008-02-18 15:40 . 2008-02-18 15:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
2008-02-17 10:52 . 2008-02-17 10:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\JollyBear
2008-02-17 00:35 . 2008-02-17 00:35 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-02-16 09:58 . 2008-02-25 12:06 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-02-16 09:57 . 2008-02-16 09:57 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-02-16 09:57 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-02-12 16:40 . 2008-02-12 16:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SnapStream
2008-02-12 16:24 . 2008-02-12 16:56 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2008-02-12 12:41 . 2008-03-06 20:53 <DIR> d-------- C:\Documents and Settings\Anthony\Application Data\VideoReDo-TVSuite
2008-02-12 10:39 . 2008-03-09 10:59 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-02-12 10:26 . 2008-02-19 11:29 <DIR> d-------- C:\Documents and Settings\Anthony\Application Data\Ahead
2008-02-12 10:25 . 2008-02-12 10:25 <DIR> d-------- C:\Program Files\Nero
2008-02-12 10:25 . 2008-02-12 10:26 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-02-12 10:25 . 2008-02-12 10:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-02-11 11:13 . 2008-03-28 12:40 <DIR> d-------- C:\my flashes
2008-02-11 11:02 . 2005-03-29 08:34 246,784 --a------ C:\WINDOWS\system32\sqlite3.dll
2008-02-09 09:29 . 2008-02-09 09:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nokia
2008-02-09 09:29 . 2007-02-22 10:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
2008-02-09 09:29 . 2007-02-22 10:15 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-02-09 09:29 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
2008-02-09 09:29 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys
2008-02-09 09:29 . 2007-02-22 10:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
2008-02-09 09:27 . 2008-02-09 09:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations
2008-02-09 09:14 . 2006-08-30 01:56 32,377 --a------ C:\WINDOWS\system32\drivers\prodigy.sys
2008-02-07 16:00 . 2008-02-07 16:00 <DIR> d--hs---- C:\Documents and Settings\Anthony\Phone Browser
2008-02-07 16:00 . 2008-02-07 22:05 <DIR> d-------- C:\Documents and Settings\Anthony\Application Data\Nokia Multimedia Player
2008-02-07 15:53 . 2008-02-07 15:53 <DIR> d-------- C:\Program Files\DIFX
2008-02-07 15:53 . 2008-02-07 15:53 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2008-02-07 15:53 . 2008-02-09 09:28 <DIR> d-------- C:\Program Files\Common Files\Nokia
2008-02-07 15:53 . 2008-02-07 22:06 <DIR> d-------- C:\Documents and Settings\Anthony\Application Data\Nokia
2008-02-07 15:53 . 2008-02-07 15:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite
2008-02-07 15:52 . 2008-02-07 15:52 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-02-07 15:52 . 2008-02-18 15:39 <DIR> d-------- C:\Program Files\Nokia
2008-02-07 15:52 . 2008-02-07 18:12 <DIR> d-------- C:\Documents and Settings\Anthony\Application Data\PC Suite
2008-02-07 15:52 . 2008-02-07 15:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2008-02-07 15:52 . 2007-02-22 10:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-02-06 17:59 . 2008-02-06 17:59 <DIR> d-------- C:\Program Files\AC3Filter
2008-02-06 17:59 . 2007-08-18 18:54 380,928 --a------ C:\WINDOWS\system32\ac3filter.acm
2008-02-02 15:25 . 2008-02-02 15:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-31 08:51 --------- d-----w C:\Program Files\eMule
2008-03-31 07:32 --------- d-----w C:\Program Files\CursorXP
2008-03-31 07:17 --------- d-----w C:\Documents and Settings\Anthony\Application Data\AVG7
2008-03-31 05:13 --------- d-----w C:\Documents and Settings\Anthony\Application Data\LumaPix
2008-03-30 22:50 --------- d-----w C:\Documents and Settings\Anthony\Application Data\MailWasherPro
2008-03-28 10:39 --------- d-----w C:\Program Files\Registry Clean Expert
2008-03-28 10:33 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-26 04:20 --------- d-----w C:\Program Files\Chattage
2008-03-04 00:04 --------- d-----w C:\Program Files\Common Files\vbAccelerator
2008-02-23 01:17 --------- d-----w C:\Program Files\AvRack
2008-02-18 04:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-18 04:39 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-15 23:03 --------- d-----w C:\Program Files\MSBuild
2008-02-14 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-14 23:03 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-12 10:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-02-06 05:28 --------- d-----w C:\Program Files\DivX
2008-01-30 07:17 --------- d-----w C:\Program Files\Microsoft Xbox 360 Accessories
2008-01-30 06:53 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01001_Coinstaller_Critical.Wdf
2008-01-30 06:53 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_xusb21_01001.Wdf
2007-12-16 13:03 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2007-12-16 13:03 249,856 ------w C:\WINDOWS\Setup1.exe
2007-12-16 03:51 47,360 ----a-w C:\Documents and Settings\Anthony\Application Data\pcouffin.sys
2007-12-16 01:24 161,304 ----a-w C:\WINDOWS\FotoFusion Uninstaller.exe
2007-12-05 09:41 49,152 ----a-w C:\WINDOWS\afaunist.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
"CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 16:44 140288]
"Center Agent"="C:\Program Files\KWorld Multimedia\HyperMediaCenter\DTVR\Scheduled.exe" [2007-07-12 18:00 1435648]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 16:14 147456]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"VD"="" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 22:32 208952]
"PHIME2002ASync"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2002-08-28 22:39 455168]
"PHIME2002A"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2002-08-28 22:39 455168]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 09:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"SoundMan"="SOUNDMAN.EXE" [2006-08-03 05:12 577536 C:\WINDOWS\soundman.exe]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 22:46 624248]
"Adobe_ID0EYTHM"="C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 16:40 1884160]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-03-31 22:02 579072]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22 86016]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"BtcMaestro"="C:\Program Files\KMaestro\KMaestro.exe" [2006-12-14 19:45 339968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-31 21:57 219136]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-08-24 03:18 437160]
"PcSync"="D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 17:15 1634304]

C:\Documents and Settings\Anthony\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-08-24 04:45:42 101784]
Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2007-12-14 15:27:15 3581680]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2007-12-12 12:01 9216 C:\WINDOWS\system32\avgwlntf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\Program Files\AlienGUIse\fastload.dll 2001-12-20 23:34 24576 C:\Program Files\AlienGUIse\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk
backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-01-15 16:14 147456 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Auto Shutdown]
--a------ 2007-09-15 11:45 1392728 C:\Program Files\PC Auto Shutdown\AutoShutdown.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2006-11-28 14:12 222720 D:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler]
--a------ 2007-08-19 01:56 450808 C:\Program Files\Registry Clean Expert\RCHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XboxStat]
--a------ 2007-09-26 18:05 734264 C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\NavDiag\\Navini Diagnostics.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"C:\\Program Files\\Ares\\Ares.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

R2 NMSSvc;Intel(R) NMS;C:\WINDOWS\System32\NMSSvc.exe [2002-05-03 12:36]
R2 ousbehci;NEC PCI to USB Enhanced Host Controller;C:\WINDOWS\system32\Drivers\ousbehci.sys [2002-07-01 13:07]
R2 PCAutoShutdown_Service;PCAutoShutdown_Service;C:\Program Files\PC Auto Shutdown\ShutdownService.exe [2007-09-14 17:03]
R3 AF15BDA;AF9015 BDA Filter;C:\WINDOWS\system32\DRIVERS\AF15BDA.sys [2007-11-20 18:18]
R3 NMSCFG;NIC Management Service Configuration Driver;C:\WINDOWS\system32\drivers\NMSCFG.SYS [2002-05-03 12:36]
R3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;C:\WINDOWS\system32\DRIVERS\ousb2hub.sys [2002-07-01 13:07]
R3 pctvvbi;PCTVVBI;C:\WINDOWS\system32\DRIVERS\pctvvbi.sys [2002-04-02 15:05]
R3 WBMS;Winbond Memory Stick Storage (MS) Device Driver;C:\WINDOWS\system32\Drivers\WBMS.SYS [2002-03-01 14:20]
S0 NVDual;NVDual;C:\WINDOWS\system32\DRIVERS\nvDual.sys []
S1 srosa;Megadrv3;C:\WINDOWS\system32\drivers\srosa.sys []
S3 WFsys;WinFox Control I/O Driver;C:\WINDOWS\system32\DRIVERS\wfsys.sys [2002-04-22 15:15]

*Newly Created Service* - NMSCFG
.
Contents of the 'Scheduled Tasks' folder
"2008-03-30 22:51:32 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-31 22:13:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\Stardock\ObjectDock\DockShellHook.dll
.
------------------------ Other Running Processes ------------------------
.
d:\Program Files\CPUCooL\CooLSrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\AlienGUIse\wbload.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
.
**************************************************************************
.
Completion time: 2008-03-31 22:20:14 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-31 11:20:11
Pre-Run: 103,919,726,592 bytes free
Post-Run: 103,494,483,968 bytes free
.
2008-03-28 09:29:03 --- E O F ---

sotong

2008-03-31, 14:51

Not enough space so I've attached HiJack This log here:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:26:41 PM, on 31/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
d:\Program Files\CPUCooL\CooLSrv.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\PC Auto Shutdown\ShutdownService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AlienGUIse\wbload.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\KMaestro\KMaestro.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\KWorld Multimedia\HyperMediaCenter\DTVR\Scheduled.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BtcMaestro] "C:\Program Files\KMaestro\KMaestro.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [Center Agent] C:\Program Files\KWorld Multimedia\HyperMediaCenter\DTVR\Scheduled.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: &Save Flash In This Page by Flash Saver - D:\PROGRA~1\FLASHS~1\save.htm
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Flash Saver - {09EA1F80-F40A-11D1-B792-444553540001} - D:\PROGRA~1\FLASHS~1\save.htm
O9 - Extra 'Tools' menuitem: Flash Saver - {09EA1F80-F40A-11D1-B792-444553540001} - D:\PROGRA~1\FLASHS~1\save.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1197275244328
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BFE15AC3-CCA2-4A85-B69B-A9D3CAA87951}: NameServer = 220.233.0.4,220.233.0.3
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: avgwlntf - C:\WINDOWS\SYSTEM32\avgwlntf.dll
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: CPUCooLServer Service (CPUCooLServer) - Unknown owner - d:\Program Files\CPUCooL\CooLSrv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCAutoShutdown_Service - GoldSolution Software, Inc. - C:\Program Files\PC Auto Shutdown\ShutdownService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 10529 bytes