edhardt
2008-05-31, 09:01
Hello, i am young and not quite as experienced with being technical with computers.
I was infected with the Vundo virus and after searching this forum i found a link to Combofix.exe
I ran that and my computer restarted, and it seems fixed, but i am not sure!
Could you please help, or let me know if it is?
This is the log from Combofix:
------------------------------------------------------------------------
ComboFix 08-05-29.1 - Annette 2008-05-30 23:34:16.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.603 [GMT -7:00]
Running from: C:\Documents and Settings\Annette\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Edmund\Application Data\macromedia\Flash Player\#SharedObjects\YW6YY4QS\www.broadcaster.com
C:\Documents and Settings\Edmund\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Edmund\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Program Files\WinBudget
C:\Program Files\WinBudget\bin\crap.1189095514.old
C:\Program Files\WinBudget\bin\crap.1191373531.old
C:\Program Files\WinBudget\bin\matrix.dll.1189095513.old
C:\WINDOWS\BMff3d6915.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\aflnbigk.dll
C:\WINDOWS\system32\AIOoonpo.ini
C:\WINDOWS\system32\AIOoonpo.ini2
C:\WINDOWS\system32\CIknWvut.ini
C:\WINDOWS\system32\CIknWvut.ini2
C:\WINDOWS\system32\drjphulr.dll
C:\WINDOWS\system32\edfbtgfl.dll
C:\WINDOWS\system32\giafkmem.dll
C:\WINDOWS\system32\gvfxtarl.dll
C:\WINDOWS\system32\KRttBJjl.ini
C:\WINDOWS\system32\KRttBJjl.ini2
C:\WINDOWS\system32\lfgtbfde.ini
C:\WINDOWS\system32\lqfvejev.dll
C:\WINDOWS\system32\lratxfvg.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nnodoprf.ini
C:\WINDOWS\system32\omqxpqay.dll
C:\WINDOWS\system32\pWGikUtv.ini
C:\WINDOWS\system32\pWGikUtv.ini2
C:\WINDOWS\system32\sjobkvhx.dll
C:\WINDOWS\system32\tcolivpv.ini
C:\WINDOWS\system32\unxaxihe.ini
C:\WINDOWS\system32\uwmpuqjc.dll
C:\WINDOWS\system32\WHggOXyb.ini
C:\WINDOWS\system32\WHggOXyb.ini2
C:\WINDOWS\system32\wmlwbgsk.dll
C:\WINDOWS\system32\wnohngsy.dll
C:\WINDOWS\system32\yaqpxqmo.ini
.
((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-31 )))))))))))))))))))))))))))))))
.
2008-05-30 22:21 . 2008-05-30 22:21 <DIR> d-------- C:\VundoFix Backups
2008-05-29 18:53 . 2008-05-29 18:53 58,880 --a------ C:\WINDOWS\system32\wvUmlLfF.dll
2008-05-29 18:53 . 2008-05-29 18:53 58,880 --a------ C:\WINDOWS\system32\ddcBSKEv.dll
2008-05-29 18:52 . 2008-05-29 18:52 58,880 --a------ C:\WINDOWS\system32\cbXOeFYs.dll
2008-05-29 18:47 . 2008-05-29 18:47 <DIR> d-------- C:\Documents and Settings\Edmund\Application Data\Sony Setup
2008-05-29 18:47 . 2008-05-29 18:47 58,880 --a------ C:\WINDOWS\system32\tuvSjHAr.dll.vir
2008-05-26 13:40 . 2008-05-30 23:44 4,958,588 --a------ C:\WINDOWS\{00000004-00000000-00000002-00001102-00000004-20061102}.BAK
2008-05-23 14:54 . 2008-05-23 14:54 <DIR> d-------- C:\WINDOWS\system32\INF
2008-05-23 14:54 . 2005-06-14 13:44 85,504 --a------ C:\WINDOWS\system32\MA_CMIDN.DLL
2008-05-23 14:54 . 2005-06-14 13:44 21,888 --a------ C:\WINDOWS\system32\drivers\MA_CMIDI.SYS
2008-05-23 14:54 . 2005-06-14 13:44 17,920 --a------ C:\WINDOWS\system32\MA_CMIDI.DLL
2008-05-23 14:54 . 2005-06-14 13:44 14,176 --a------ C:\WINDOWS\system32\MA_CMIDI.DRV
2008-05-23 14:54 . 2005-06-14 13:44 7,282 --a------ C:\WINDOWS\system32\MA_CMIDI.VXD
2008-05-23 14:09 . 2008-05-24 10:43 <DIR> d-------- C:\Program Files\M-Audio MA_CMIDI
2008-05-21 23:54 . 2008-05-21 23:54 <DIR> d-------- C:\Documents and Settings\Dad\Application Data\Skype
2008-05-21 23:41 . 2008-05-21 23:50 <DIR> d-------- C:\Documents and Settings\Dad\Application Data\AVG7
2008-05-21 17:54 . 2008-05-21 17:54 <DIR> d-------- C:\Documents and Settings\Edmund\Application Data\tmp
2008-05-21 17:54 . 2008-05-21 17:54 <DIR> d-------- C:\Documents and Settings\Edmund\Application Data\Reallusion
2008-05-21 13:50 . 2008-05-21 13:50 <DIR> d-------- C:\Documents and Settings\Mom\Application Data\BitTorrent
2008-05-21 13:00 . 2008-05-21 13:00 <DIR> d-------- C:\Program Files\Citrix
2008-05-21 12:57 . 2008-05-21 12:57 <DIR> d-------- C:\Program Files\Valco Data Systems
2008-05-21 12:57 . 2008-05-21 12:57 <DIR> d-------- C:\lva
2008-05-21 12:52 . 2008-05-21 13:46 <DIR> d-------- C:\Program Files\NetAccess SSL
2008-05-21 12:52 . 2008-05-21 12:52 <DIR> d-------- C:\Program Files\MEDITECH
2008-05-21 12:46 . 2008-05-21 13:12 <DIR> d-------- C:\Documents and Settings\Mom\Application Data\AdobeUM
2008-05-21 12:44 . 2008-05-21 12:49 <DIR> d-------- C:\Documents and Settings\Mom\Application Data\AVG7
2008-05-20 19:59 . 2008-05-20 19:59 <DIR> d-------- C:\Documents and Settings\Edmund\Application Data\FabFilter
2008-05-20 19:59 . 2008-05-20 19:59 1,025 --a------ C:\WINDOWS\system32\sysprs7.tgz
2008-05-20 19:59 . 2008-05-20 19:59 1,025 --a------ C:\WINDOWS\system32\sysprs7.dll
2008-05-20 19:59 . 2008-05-20 19:59 1,025 --a------ C:\WINDOWS\system32\clauth2.dll
2008-05-20 19:59 . 2008-05-20 19:59 1,025 --a------ C:\WINDOWS\system32\clauth1.dll
2008-05-20 19:59 . 2008-05-29 19:57 219 --a------ C:\WINDOWS\system32\lsprst7.tgz
2008-05-20 19:59 . 2008-05-29 19:57 205 --a------ C:\WINDOWS\system32\lsprst7.dll
2008-05-20 19:59 . 2008-05-29 19:57 87 --a------ C:\WINDOWS\system32\ssprs.tgz
2008-05-20 19:59 . 2008-05-29 19:57 73 --a------ C:\WINDOWS\system32\ssprs.dll
2008-05-19 16:25 . 2008-05-19 16:25 <DIR> d-------- C:\Program Files\Disney
2008-05-15 15:48 . 2008-05-15 15:48 <DIR> d-------- C:\Program Files\u-he
2008-05-15 15:42 . 2006-09-14 01:21 2,240 --a------ C:\WINDOWS\LENDIG.sys
2008-05-15 15:34 . 2008-05-15 15:34 <DIR> d-------- C:\Program Files\iZotope
2008-05-15 15:34 . 2008-05-15 15:34 <DIR> d-------- C:\Program Files\Common Files\iZotope
2008-05-15 15:30 . 2008-05-15 15:32 <DIR> d-------- C:\Program Files\WWAYM
2008-05-15 15:25 . 2008-05-15 15:39 <DIR> d-------- C:\Program Files\LUXONIX
2008-05-15 15:22 . 2008-05-15 15:22 <DIR> d-------- C:\Program Files\KORG
2008-05-15 15:22 . 2008-05-15 15:22 <DIR> d-------- C:\Program Files\Common Files\KORG
2008-05-11 19:27 . 2008-05-11 19:27 <DIR> d-------- C:\Program Files\steinberg
2008-05-10 17:32 . 2008-05-11 18:19 <DIR> d-------- C:\Program Files\Common Files\Native Instruments
2008-05-08 18:16 . 2008-05-13 16:47 <DIR> d-------- C:\LimeWire
2008-05-08 18:10 . 2008-05-08 18:13 <DIR> d-------- C:\Program Files\EndItAll
2008-05-04 15:29 . 2008-05-04 15:29 900,015 --a------ C:\WINDOWS\system32\TmpA1723360640
2008-05-04 15:27 . 2008-05-04 15:27 <DIR> d-------- C:\Program Files\Common Files\Digidesign
2008-05-04 15:27 . 2008-05-04 15:39 <DIR> d-------- C:\Program Files\Antares Audio Technologies
2008-05-04 15:27 . 2003-06-20 13:28 1,777,664 --a------ C:\WINDOWS\system32\gdiplus.dll
2008-05-03 21:11 . 2008-05-03 21:14 <DIR> d-------- C:\Documents and Settings\Edmund\Application Data\Deckadance
2008-05-03 18:53 . 2008-05-03 18:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Ahead
2008-04-29 17:37 . 2008-04-29 17:37 <DIR> d-------- C:\Program Files\M-Audio
2008-04-29 17:37 . 2005-08-11 15:29 73,728 --a------ C:\WINDOWS\system32\ISUSPM.cpl
2008-04-24 18:08 . 2008-04-24 18:08 <DIR> d-------- C:\Documents and Settings\Edmund\Application Data\Ableton
2008-04-24 18:08 . 2008-04-24 18:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Ableton
2008-04-24 18:05 . 2008-04-24 18:05 <DIR> d-------- C:\Program Files\Ableton
2008-04-18 08:12 . 2008-04-18 08:12 151,552 --a------ C:\WINDOWS\system32\InaGrid.ocx
2008-04-18 08:12 . 2008-04-18 08:12 89,600 -ra------ C:\WINDOWS\system32\MSCAL.OCX
2008-04-18 08:12 . 2008-04-18 08:12 36,864 --a------ C:\WINDOWS\system32\InaCombo.ocx
2008-04-18 08:12 . 2008-04-18 08:12 32,768 --a------ C:\WINDOWS\system32\InaEdit.ocx
2008-04-18 08:12 . 2008-04-18 08:12 32,768 --a------ C:\WINDOWS\system32\InaCheck.ocx
2008-04-18 08:12 . 2008-04-18 08:12 405 --a------ C:\WINDOWS\system32\InaGrid.lic
2008-04-16 17:08 . 2008-04-16 17:08 <DIR> d-------- C:\Program Files\AnalogX
2008-04-12 12:49 . 2008-04-12 12:49 <DIR> d-------- C:\Program Files\AAS
2008-04-12 12:49 . 2008-04-12 12:49 <DIR> d-------- C:\Documents and Settings\Edmund\Application Data\Applied Acoustics Systems
2008-04-12 12:35 . 2008-04-12 12:35 <DIR> d-------- C:\Documents and Settings\Edmund\Application Data\NetMedia Providers
2008-04-12 12:31 . 2008-04-12 12:31 <DIR> d--h----- C:\WINDOWS\PIF
2008-04-12 12:22 . 2008-04-12 12:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony
2008-04-12 12:19 . 2008-05-29 18:47 <DIR> d-------- C:\Program Files\Sony Setup
2008-04-12 00:50 . 2008-05-11 08:00 <DIR> d-------- C:\Documents and Settings\Annette\Application Data\AVG7
2008-04-11 16:24 . 2008-05-30 22:26 <DIR> dr-h----- C:\$VAULT$.AVG
2008-04-11 16:00 . 2008-04-11 16:00 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-04-11 16:00 . 2008-05-29 19:50 <DIR> d-------- C:\Documents and Settings\Edmund\Application Data\AVG7
2008-04-11 15:59 . 2008-04-11 15:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-11 15:59 . 2008-05-30 22:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-04-07 17:50 . 2008-05-15 15:27 <DIR> d-------- C:\Program Files\Native Instruments
2008-04-05 14:45 . 2002-07-07 15:14 1,294,336 --a------ C:\WINDOWS\system32\vorbis.acm
2008-04-05 14:43 . 2008-04-05 14:43 <DIR> d-------- C:\Program Files\Outsim
2008-04-05 14:41 . 2008-05-15 15:43 <DIR> d-------- C:\Program Files\Image-Line
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-30 03:24 --------- d-----w C:\Documents and Settings\Edmund\Application Data\Publish Providers
2008-05-30 02:36 --------- d-----w C:\Program Files\Sony
2008-05-30 01:51 --------- d-----w C:\Documents and Settings\Edmund\Application Data\Sony
2008-05-27 06:37 --------- d-----w C:\Program Files\VCW VicMan's Photo Editor
2008-05-23 21:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-15 22:48 --------- d-----w C:\Program Files\Vstplugins
2008-05-13 23:47 --------- d-----w C:\Program Files\WarRock
2008-05-13 23:47 --------- d-----w C:\Program Files\ordrumbox
2008-05-13 01:33 --------- d-----w C:\Program Files\Last.fm
2008-05-11 00:34 --------- d-----w C:\Program Files\Opera
2008-05-09 01:16 --------- d-----w C:\Program Files\LimeWire
2008-04-26 02:34 --------- d-----w C:\Documents and Settings\Annette\Application Data\Skype
2008-04-26 02:32 --------- d-----w C:\Documents and Settings\Annette\Application Data\skypePM
2008-04-15 03:25 --------- d-----w C:\Program Files\Winamp
2008-04-12 21:06 --------- d-----w C:\Program Files\Microsoft SQL Server
2008-04-12 17:36 --------- d-----w C:\Program Files\Symantec Client Security
2008-04-12 17:36 --------- d-----w C:\Program Files\Symantec
2008-04-12 17:36 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-04-12 17:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-04-05 20:42 --------- d-----w C:\Program Files\BitTorrent
2008-03-31 04:37 --------- d-----w C:\Documents and Settings\Dad\Application Data\Apple Computer
2008-03-30 04:26 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-03-30 04:26 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-03-28 03:02 --------- d-----w C:\Program Files\Maxthon2
2008-03-28 03:01 --------- d-----w C:\Documents and Settings\Edmund\Application Data\MxBoost
2008-01-21 22:17 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2007-08-19 23:26 16,504,464 ----a-w C:\Program Files\jre-1_5_0_08-windows-i586-p.exe
2007-05-20 04:41 1,324,987 ----a-w C:\Program Files\CarViewer.zip
2007-03-02 01:02 36,808,256 ----a-w C:\Program Files\iTunesSetup.exe
2007-02-19 22:11 4,762,918 ----a-w C:\Program Files\pspVideo9_Install.exe
2007-02-18 19:44 6,196,681 ----a-w C:\Program Files\BitTorrent-5.0.5.exe
2007-02-10 03:56 118,224,046 ----a-w C:\Program Files\MOHHServerSetupNA.exe
2008-02-08 04:46 13,624 ----a-w C:\Program Files\mozilla firefox\plugins\cgpcfg.dll
2008-02-08 04:46 87,360 ----a-w C:\Program Files\mozilla firefox\plugins\CgpCore.dll
2008-02-08 04:46 91,448 ----a-w C:\Program Files\mozilla firefox\plugins\confmgr.dll
2006-06-16 04:33 233,472 ----a-w C:\Program Files\mozilla firefox\plugins\CrazyTalk4Native.dll
2006-05-26 02:43 204,895 ----a-w C:\Program Files\mozilla firefox\plugins\ctdomemhelper.dll
2005-09-29 22:41 77,824 ----a-w C:\Program Files\mozilla firefox\plugins\ctframeplayerobject.dll
2006-06-19 21:10 426,081 ----a-w C:\Program Files\mozilla firefox\plugins\ctplayerobject.dll
2008-02-08 04:46 21,824 ----a-w C:\Program Files\mozilla firefox\plugins\ctxlogging.dll
2008-02-08 04:46 206,136 ----a-w C:\Program Files\mozilla firefox\plugins\ctxmui.dll
2008-02-08 04:46 31,544 ----a-w C:\Program Files\mozilla firefox\plugins\icafile.dll
2008-02-08 04:46 40,248 ----a-w C:\Program Files\mozilla firefox\plugins\icalogon.dll
2005-02-02 20:19 458,752 ----a-w C:\Program Files\mozilla firefox\plugins\imagickrt.dll
2007-03-17 00:27 479,232 ----a-w C:\Program Files\mozilla firefox\plugins\msvcm80.dll
2007-03-17 00:27 548,864 ----a-w C:\Program Files\mozilla firefox\plugins\msvcp80.dll
2007-03-17 00:27 626,688 ----a-w C:\Program Files\mozilla firefox\plugins\msvcr80.dll
2006-04-11 02:35 139,264 ----a-w C:\Program Files\mozilla firefox\plugins\rlcontentclass.dll
2005-11-09 19:10 204,800 ----a-w C:\Program Files\mozilla firefox\plugins\RLMusicPacker.dll
2005-11-09 19:42 106,496 ----a-w C:\Program Files\mozilla firefox\plugins\RLMusicUnpacker.dll
2006-01-04 19:22 212,992 ----a-w C:\Program Files\mozilla firefox\plugins\RLVoicePacker.dll
2006-01-04 19:21 167,936 ----a-w C:\Program Files\mozilla firefox\plugins\RLVoiceUnpacker.dll
2007-07-20 19:47 981,170 ----a-w C:\Program Files\mozilla firefox\plugins\sslsdk_b.dll
2008-02-08 04:46 24,384 ----a-w C:\Program Files\mozilla firefox\plugins\TcpPServ.dll
2008-01-21 22:24 75 --sh--r C:\WINDOWS\CT4CET.bin
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
----a-w 483,328 2004-12-14 10:12:02 C:\Program Files\Adobe\Acrobat 7.0\Distillr\bak\Acrotray.exe
----a-w 483,328 2006-01-13 03:52:32 C:\Program Files\Adobe\Acrobat 7.0\Distillr\AcroTray.exe
----a-w 67,112 2006-08-01 23:35:36 C:\Program Files\AIM\bak\aim.exe
----a-w 67,112 2006-08-01 23:35:36 C:\Program Files\AIM\aim.exe
----a-w 155,648 2006-01-13 00:40:44 C:\Program Files\Common Files\Ahead\Lib\bak\NeroCheck.exe
----a-w 53,408 2006-03-25 01:14:48 C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe
----a-w 241,664 2003-12-22 16:38:42 C:\Program Files\HP\hpcoretech\bak\hpcmpmgr.exe
----a-w 324 2008-04-12 07:47:44 C:\Program Files\HP\hpcoretech\bak\data\EvntData-543229842.xml
----a-w 49,263 2006-11-09 23:07:30 C:\Program Files\Java\jre1.5.0_10\bin\bak\jusched.exe
----a-w 282,624 2007-02-06 23:18:25 C:\Program Files\QuickTime\bak\qttask.exe
----a-w 286,720 2007-06-29 13:24:52 C:\Program Files\QuickTime\QTTask.exe
----a-w 124,656 2006-06-15 09:40:34 C:\Program Files\Symantec Client Security\Symantec AntiVirus\bak\VPTray.exe
----a-w 35,328 2006-06-21 17:14:50 C:\Program Files\Winamp\bak\winampa.exe
----a-w 15,360 2004-08-04 01:07:00 C:\WINDOWS\system32\bak\ctfmon.exe
----a-w 15,360 2004-08-04 01:07:00 C:\WINDOWS\system32\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5BA7292A-0FD9-4AA1-84A2-6A812D9AACA4}]
C:\WINDOWS\system32\tuvWnkIC.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 18:07 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-26 00:14 68856]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-04-21 18:03 94208]
"Creative Live! Cam Manager"="C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2007-06-07 15:01 155648]
"CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-11-17 02:42 53341]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-01-03 09:15 50528]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 11:37 2321600]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-12-15 13:01 5513216]
"CTHelper"="CTHELPER.EXE" [2006-08-11 15:56 17920 C:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-11 15:56 18944 C:\WINDOWS\system32\CTXFIHLP.EXE]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52 483328]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 14:22 3739648]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18 270648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"V0410Mon.exe"="C:\WINDOWS\V0410Mon.exe" [2007-06-06 18:00 32768]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-17 09:01 579584]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-11 16:00 219136]
C:\Documents and Settings\Edmund\Start Menu\Programs\Startup\
MEMonitor.lnk - C:\Program Files\Verizon Wireless\V CAST Music Manager\MEMonitor.exe [2007-11-14 21:28:13 947544]
C:\Documents and Settings\Annette\Start Menu\Programs\Startup\
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2008-02-16 16:14:02 106496]
Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2007-05-01 19:37:06 344064]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2007-01-23 19:12:59 25214]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-05-28 18:53:52 0]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"C:\\Program Files\\CyberLink\\PowerDirector\\PDR.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\LimeWire\\LimeWire.exe"=
R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe [2004-08-03 18:07]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 14:38]
R3 RLDesignVirtualAudioCableWdm;Live! Cam Virtual;C:\WINDOWS\system32\DRIVERS\livecamv.sys [2007-01-15 18:57]
S3 dpartmgr;dpartmgr;C:\DOCUME~1\Edmund\LOCALS~1\Temp\dpartmgr.sys []
S3 MA_CMIDI;%EVOL_USB.SvcDesc%;C:\WINDOWS\system32\drivers\ma_cmidi.sys [2005-06-14 13:44]
S3 V0410Afx;Creative Camera VF0410 Audio Effects Driver;C:\WINDOWS\system32\DRIVERS\V0410Afx.sys [2007-06-10 18:01]
S3 V0410Aud;Creative Camera VF0410 Noise Cancellation APO;C:\WINDOWS\system32\DRIVERS\V0410Aud.sys [2007-02-14 03:14]
S3 V0410Dev;Creative Camera VF0410 Driver;C:\WINDOWS\system32\DRIVERS\V0410Dev.sys [2007-07-03 18:00]
S3 V0410Vfx;Creative Camera VF0410 Video VFX Driver;C:\WINDOWS\system32\DRIVERS\V0410Vfx.sys [2006-12-04 22:37]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
"2008-05-31 00:15:00 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-05-28 19:02:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-05-28 07:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-28 16:00:00 C:\WINDOWS\Tasks\At10.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-28 17:00:00 C:\WINDOWS\Tasks\At11.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-28 18:00:00 C:\WINDOWS\Tasks\At12.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-30 19:00:00 C:\WINDOWS\Tasks\At13.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-30 20:00:00 C:\WINDOWS\Tasks\At14.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-30 21:00:00 C:\WINDOWS\Tasks\At15.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-30 22:00:00 C:\WINDOWS\Tasks\At16.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-30 23:00:00 C:\WINDOWS\Tasks\At17.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-31 00:00:00 C:\WINDOWS\Tasks\At18.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-31 01:00:00 C:\WINDOWS\Tasks\At19.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-28 08:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-31 02:00:00 C:\WINDOWS\Tasks\At20.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-31 03:00:03 C:\WINDOWS\Tasks\At21.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-31 04:00:01 C:\WINDOWS\Tasks\At22.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-31 05:00:00 C:\WINDOWS\Tasks\At23.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-31 06:00:00 C:\WINDOWS\Tasks\At24.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-30 09:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-26 10:00:00 C:\WINDOWS\Tasks\At4.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-20 11:00:00 C:\WINDOWS\Tasks\At5.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-20 12:00:00 C:\WINDOWS\Tasks\At6.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-20 13:00:00 C:\WINDOWS\Tasks\At7.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-20 14:00:00 C:\WINDOWS\Tasks\At8.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-20 15:00:00 C:\WINDOWS\Tasks\At9.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-30 23:47:04
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
.
**************************************************************************
.
Completion time: 2008-05-30 23:59:27 - machine was rebooted [Annette]
ComboFix-quarantined-files.txt 2008-05-31 06:59:25
Pre-Run: 186,639,589,376 bytes free
Post-Run: 187,571,957,760 bytes free
363
Thank you so very much in advance!!
I was infected with the Vundo virus and after searching this forum i found a link to Combofix.exe
I ran that and my computer restarted, and it seems fixed, but i am not sure!
Could you please help, or let me know if it is?
This is the log from Combofix:
------------------------------------------------------------------------
ComboFix 08-05-29.1 - Annette 2008-05-30 23:34:16.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.603 [GMT -7:00]
Running from: C:\Documents and Settings\Annette\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Edmund\Application Data\macromedia\Flash Player\#SharedObjects\YW6YY4QS\www.broadcaster.com
C:\Documents and Settings\Edmund\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Edmund\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Program Files\WinBudget
C:\Program Files\WinBudget\bin\crap.1189095514.old
C:\Program Files\WinBudget\bin\crap.1191373531.old
C:\Program Files\WinBudget\bin\matrix.dll.1189095513.old
C:\WINDOWS\BMff3d6915.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\aflnbigk.dll
C:\WINDOWS\system32\AIOoonpo.ini
C:\WINDOWS\system32\AIOoonpo.ini2
C:\WINDOWS\system32\CIknWvut.ini
C:\WINDOWS\system32\CIknWvut.ini2
C:\WINDOWS\system32\drjphulr.dll
C:\WINDOWS\system32\edfbtgfl.dll
C:\WINDOWS\system32\giafkmem.dll
C:\WINDOWS\system32\gvfxtarl.dll
C:\WINDOWS\system32\KRttBJjl.ini
C:\WINDOWS\system32\KRttBJjl.ini2
C:\WINDOWS\system32\lfgtbfde.ini
C:\WINDOWS\system32\lqfvejev.dll
C:\WINDOWS\system32\lratxfvg.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nnodoprf.ini
C:\WINDOWS\system32\omqxpqay.dll
C:\WINDOWS\system32\pWGikUtv.ini
C:\WINDOWS\system32\pWGikUtv.ini2
C:\WINDOWS\system32\sjobkvhx.dll
C:\WINDOWS\system32\tcolivpv.ini
C:\WINDOWS\system32\unxaxihe.ini
C:\WINDOWS\system32\uwmpuqjc.dll
C:\WINDOWS\system32\WHggOXyb.ini
C:\WINDOWS\system32\WHggOXyb.ini2
C:\WINDOWS\system32\wmlwbgsk.dll
C:\WINDOWS\system32\wnohngsy.dll
C:\WINDOWS\system32\yaqpxqmo.ini
.
((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-31 )))))))))))))))))))))))))))))))
.
2008-05-30 22:21 . 2008-05-30 22:21 <DIR> d-------- C:\VundoFix Backups
2008-05-29 18:53 . 2008-05-29 18:53 58,880 --a------ C:\WINDOWS\system32\wvUmlLfF.dll
2008-05-29 18:53 . 2008-05-29 18:53 58,880 --a------ C:\WINDOWS\system32\ddcBSKEv.dll
2008-05-29 18:52 . 2008-05-29 18:52 58,880 --a------ C:\WINDOWS\system32\cbXOeFYs.dll
2008-05-29 18:47 . 2008-05-29 18:47 <DIR> d-------- C:\Documents and Settings\Edmund\Application Data\Sony Setup
2008-05-29 18:47 . 2008-05-29 18:47 58,880 --a------ C:\WINDOWS\system32\tuvSjHAr.dll.vir
2008-05-26 13:40 . 2008-05-30 23:44 4,958,588 --a------ C:\WINDOWS\{00000004-00000000-00000002-00001102-00000004-20061102}.BAK
2008-05-23 14:54 . 2008-05-23 14:54 <DIR> d-------- C:\WINDOWS\system32\INF
2008-05-23 14:54 . 2005-06-14 13:44 85,504 --a------ C:\WINDOWS\system32\MA_CMIDN.DLL
2008-05-23 14:54 . 2005-06-14 13:44 21,888 --a------ C:\WINDOWS\system32\drivers\MA_CMIDI.SYS
2008-05-23 14:54 . 2005-06-14 13:44 17,920 --a------ C:\WINDOWS\system32\MA_CMIDI.DLL
2008-05-23 14:54 . 2005-06-14 13:44 14,176 --a------ C:\WINDOWS\system32\MA_CMIDI.DRV
2008-05-23 14:54 . 2005-06-14 13:44 7,282 --a------ C:\WINDOWS\system32\MA_CMIDI.VXD
2008-05-23 14:09 . 2008-05-24 10:43 <DIR> d-------- C:\Program Files\M-Audio MA_CMIDI
2008-05-21 23:54 . 2008-05-21 23:54 <DIR> d-------- C:\Documents and Settings\Dad\Application Data\Skype
2008-05-21 23:41 . 2008-05-21 23:50 <DIR> d-------- C:\Documents and Settings\Dad\Application Data\AVG7
2008-05-21 17:54 . 2008-05-21 17:54 <DIR> d-------- C:\Documents and Settings\Edmund\Application Data\tmp
2008-05-21 17:54 . 2008-05-21 17:54 <DIR> d-------- C:\Documents and Settings\Edmund\Application Data\Reallusion
2008-05-21 13:50 . 2008-05-21 13:50 <DIR> d-------- C:\Documents and Settings\Mom\Application Data\BitTorrent
2008-05-21 13:00 . 2008-05-21 13:00 <DIR> d-------- C:\Program Files\Citrix
2008-05-21 12:57 . 2008-05-21 12:57 <DIR> d-------- C:\Program Files\Valco Data Systems
2008-05-21 12:57 . 2008-05-21 12:57 <DIR> d-------- C:\lva
2008-05-21 12:52 . 2008-05-21 13:46 <DIR> d-------- C:\Program Files\NetAccess SSL
2008-05-21 12:52 . 2008-05-21 12:52 <DIR> d-------- C:\Program Files\MEDITECH
2008-05-21 12:46 . 2008-05-21 13:12 <DIR> d-------- C:\Documents and Settings\Mom\Application Data\AdobeUM
2008-05-21 12:44 . 2008-05-21 12:49 <DIR> d-------- C:\Documents and Settings\Mom\Application Data\AVG7
2008-05-20 19:59 . 2008-05-20 19:59 <DIR> d-------- C:\Documents and Settings\Edmund\Application Data\FabFilter
2008-05-20 19:59 . 2008-05-20 19:59 1,025 --a------ C:\WINDOWS\system32\sysprs7.tgz
2008-05-20 19:59 . 2008-05-20 19:59 1,025 --a------ C:\WINDOWS\system32\sysprs7.dll
2008-05-20 19:59 . 2008-05-20 19:59 1,025 --a------ C:\WINDOWS\system32\clauth2.dll
2008-05-20 19:59 . 2008-05-20 19:59 1,025 --a------ C:\WINDOWS\system32\clauth1.dll
2008-05-20 19:59 . 2008-05-29 19:57 219 --a------ C:\WINDOWS\system32\lsprst7.tgz
2008-05-20 19:59 . 2008-05-29 19:57 205 --a------ C:\WINDOWS\system32\lsprst7.dll
2008-05-20 19:59 . 2008-05-29 19:57 87 --a------ C:\WINDOWS\system32\ssprs.tgz
2008-05-20 19:59 . 2008-05-29 19:57 73 --a------ C:\WINDOWS\system32\ssprs.dll
2008-05-19 16:25 . 2008-05-19 16:25 <DIR> d-------- C:\Program Files\Disney
2008-05-15 15:48 . 2008-05-15 15:48 <DIR> d-------- C:\Program Files\u-he
2008-05-15 15:42 . 2006-09-14 01:21 2,240 --a------ C:\WINDOWS\LENDIG.sys
2008-05-15 15:34 . 2008-05-15 15:34 <DIR> d-------- C:\Program Files\iZotope
2008-05-15 15:34 . 2008-05-15 15:34 <DIR> d-------- C:\Program Files\Common Files\iZotope
2008-05-15 15:30 . 2008-05-15 15:32 <DIR> d-------- C:\Program Files\WWAYM
2008-05-15 15:25 . 2008-05-15 15:39 <DIR> d-------- C:\Program Files\LUXONIX
2008-05-15 15:22 . 2008-05-15 15:22 <DIR> d-------- C:\Program Files\KORG
2008-05-15 15:22 . 2008-05-15 15:22 <DIR> d-------- C:\Program Files\Common Files\KORG
2008-05-11 19:27 . 2008-05-11 19:27 <DIR> d-------- C:\Program Files\steinberg
2008-05-10 17:32 . 2008-05-11 18:19 <DIR> d-------- C:\Program Files\Common Files\Native Instruments
2008-05-08 18:16 . 2008-05-13 16:47 <DIR> d-------- C:\LimeWire
2008-05-08 18:10 . 2008-05-08 18:13 <DIR> d-------- C:\Program Files\EndItAll
2008-05-04 15:29 . 2008-05-04 15:29 900,015 --a------ C:\WINDOWS\system32\TmpA1723360640
2008-05-04 15:27 . 2008-05-04 15:27 <DIR> d-------- C:\Program Files\Common Files\Digidesign
2008-05-04 15:27 . 2008-05-04 15:39 <DIR> d-------- C:\Program Files\Antares Audio Technologies
2008-05-04 15:27 . 2003-06-20 13:28 1,777,664 --a------ C:\WINDOWS\system32\gdiplus.dll
2008-05-03 21:11 . 2008-05-03 21:14 <DIR> d-------- C:\Documents and Settings\Edmund\Application Data\Deckadance
2008-05-03 18:53 . 2008-05-03 18:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Ahead
2008-04-29 17:37 . 2008-04-29 17:37 <DIR> d-------- C:\Program Files\M-Audio
2008-04-29 17:37 . 2005-08-11 15:29 73,728 --a------ C:\WINDOWS\system32\ISUSPM.cpl
2008-04-24 18:08 . 2008-04-24 18:08 <DIR> d-------- C:\Documents and Settings\Edmund\Application Data\Ableton
2008-04-24 18:08 . 2008-04-24 18:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Ableton
2008-04-24 18:05 . 2008-04-24 18:05 <DIR> d-------- C:\Program Files\Ableton
2008-04-18 08:12 . 2008-04-18 08:12 151,552 --a------ C:\WINDOWS\system32\InaGrid.ocx
2008-04-18 08:12 . 2008-04-18 08:12 89,600 -ra------ C:\WINDOWS\system32\MSCAL.OCX
2008-04-18 08:12 . 2008-04-18 08:12 36,864 --a------ C:\WINDOWS\system32\InaCombo.ocx
2008-04-18 08:12 . 2008-04-18 08:12 32,768 --a------ C:\WINDOWS\system32\InaEdit.ocx
2008-04-18 08:12 . 2008-04-18 08:12 32,768 --a------ C:\WINDOWS\system32\InaCheck.ocx
2008-04-18 08:12 . 2008-04-18 08:12 405 --a------ C:\WINDOWS\system32\InaGrid.lic
2008-04-16 17:08 . 2008-04-16 17:08 <DIR> d-------- C:\Program Files\AnalogX
2008-04-12 12:49 . 2008-04-12 12:49 <DIR> d-------- C:\Program Files\AAS
2008-04-12 12:49 . 2008-04-12 12:49 <DIR> d-------- C:\Documents and Settings\Edmund\Application Data\Applied Acoustics Systems
2008-04-12 12:35 . 2008-04-12 12:35 <DIR> d-------- C:\Documents and Settings\Edmund\Application Data\NetMedia Providers
2008-04-12 12:31 . 2008-04-12 12:31 <DIR> d--h----- C:\WINDOWS\PIF
2008-04-12 12:22 . 2008-04-12 12:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony
2008-04-12 12:19 . 2008-05-29 18:47 <DIR> d-------- C:\Program Files\Sony Setup
2008-04-12 00:50 . 2008-05-11 08:00 <DIR> d-------- C:\Documents and Settings\Annette\Application Data\AVG7
2008-04-11 16:24 . 2008-05-30 22:26 <DIR> dr-h----- C:\$VAULT$.AVG
2008-04-11 16:00 . 2008-04-11 16:00 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-04-11 16:00 . 2008-05-29 19:50 <DIR> d-------- C:\Documents and Settings\Edmund\Application Data\AVG7
2008-04-11 15:59 . 2008-04-11 15:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-11 15:59 . 2008-05-30 22:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-04-07 17:50 . 2008-05-15 15:27 <DIR> d-------- C:\Program Files\Native Instruments
2008-04-05 14:45 . 2002-07-07 15:14 1,294,336 --a------ C:\WINDOWS\system32\vorbis.acm
2008-04-05 14:43 . 2008-04-05 14:43 <DIR> d-------- C:\Program Files\Outsim
2008-04-05 14:41 . 2008-05-15 15:43 <DIR> d-------- C:\Program Files\Image-Line
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-30 03:24 --------- d-----w C:\Documents and Settings\Edmund\Application Data\Publish Providers
2008-05-30 02:36 --------- d-----w C:\Program Files\Sony
2008-05-30 01:51 --------- d-----w C:\Documents and Settings\Edmund\Application Data\Sony
2008-05-27 06:37 --------- d-----w C:\Program Files\VCW VicMan's Photo Editor
2008-05-23 21:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-15 22:48 --------- d-----w C:\Program Files\Vstplugins
2008-05-13 23:47 --------- d-----w C:\Program Files\WarRock
2008-05-13 23:47 --------- d-----w C:\Program Files\ordrumbox
2008-05-13 01:33 --------- d-----w C:\Program Files\Last.fm
2008-05-11 00:34 --------- d-----w C:\Program Files\Opera
2008-05-09 01:16 --------- d-----w C:\Program Files\LimeWire
2008-04-26 02:34 --------- d-----w C:\Documents and Settings\Annette\Application Data\Skype
2008-04-26 02:32 --------- d-----w C:\Documents and Settings\Annette\Application Data\skypePM
2008-04-15 03:25 --------- d-----w C:\Program Files\Winamp
2008-04-12 21:06 --------- d-----w C:\Program Files\Microsoft SQL Server
2008-04-12 17:36 --------- d-----w C:\Program Files\Symantec Client Security
2008-04-12 17:36 --------- d-----w C:\Program Files\Symantec
2008-04-12 17:36 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-04-12 17:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-04-05 20:42 --------- d-----w C:\Program Files\BitTorrent
2008-03-31 04:37 --------- d-----w C:\Documents and Settings\Dad\Application Data\Apple Computer
2008-03-30 04:26 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-03-30 04:26 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-03-28 03:02 --------- d-----w C:\Program Files\Maxthon2
2008-03-28 03:01 --------- d-----w C:\Documents and Settings\Edmund\Application Data\MxBoost
2008-01-21 22:17 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2007-08-19 23:26 16,504,464 ----a-w C:\Program Files\jre-1_5_0_08-windows-i586-p.exe
2007-05-20 04:41 1,324,987 ----a-w C:\Program Files\CarViewer.zip
2007-03-02 01:02 36,808,256 ----a-w C:\Program Files\iTunesSetup.exe
2007-02-19 22:11 4,762,918 ----a-w C:\Program Files\pspVideo9_Install.exe
2007-02-18 19:44 6,196,681 ----a-w C:\Program Files\BitTorrent-5.0.5.exe
2007-02-10 03:56 118,224,046 ----a-w C:\Program Files\MOHHServerSetupNA.exe
2008-02-08 04:46 13,624 ----a-w C:\Program Files\mozilla firefox\plugins\cgpcfg.dll
2008-02-08 04:46 87,360 ----a-w C:\Program Files\mozilla firefox\plugins\CgpCore.dll
2008-02-08 04:46 91,448 ----a-w C:\Program Files\mozilla firefox\plugins\confmgr.dll
2006-06-16 04:33 233,472 ----a-w C:\Program Files\mozilla firefox\plugins\CrazyTalk4Native.dll
2006-05-26 02:43 204,895 ----a-w C:\Program Files\mozilla firefox\plugins\ctdomemhelper.dll
2005-09-29 22:41 77,824 ----a-w C:\Program Files\mozilla firefox\plugins\ctframeplayerobject.dll
2006-06-19 21:10 426,081 ----a-w C:\Program Files\mozilla firefox\plugins\ctplayerobject.dll
2008-02-08 04:46 21,824 ----a-w C:\Program Files\mozilla firefox\plugins\ctxlogging.dll
2008-02-08 04:46 206,136 ----a-w C:\Program Files\mozilla firefox\plugins\ctxmui.dll
2008-02-08 04:46 31,544 ----a-w C:\Program Files\mozilla firefox\plugins\icafile.dll
2008-02-08 04:46 40,248 ----a-w C:\Program Files\mozilla firefox\plugins\icalogon.dll
2005-02-02 20:19 458,752 ----a-w C:\Program Files\mozilla firefox\plugins\imagickrt.dll
2007-03-17 00:27 479,232 ----a-w C:\Program Files\mozilla firefox\plugins\msvcm80.dll
2007-03-17 00:27 548,864 ----a-w C:\Program Files\mozilla firefox\plugins\msvcp80.dll
2007-03-17 00:27 626,688 ----a-w C:\Program Files\mozilla firefox\plugins\msvcr80.dll
2006-04-11 02:35 139,264 ----a-w C:\Program Files\mozilla firefox\plugins\rlcontentclass.dll
2005-11-09 19:10 204,800 ----a-w C:\Program Files\mozilla firefox\plugins\RLMusicPacker.dll
2005-11-09 19:42 106,496 ----a-w C:\Program Files\mozilla firefox\plugins\RLMusicUnpacker.dll
2006-01-04 19:22 212,992 ----a-w C:\Program Files\mozilla firefox\plugins\RLVoicePacker.dll
2006-01-04 19:21 167,936 ----a-w C:\Program Files\mozilla firefox\plugins\RLVoiceUnpacker.dll
2007-07-20 19:47 981,170 ----a-w C:\Program Files\mozilla firefox\plugins\sslsdk_b.dll
2008-02-08 04:46 24,384 ----a-w C:\Program Files\mozilla firefox\plugins\TcpPServ.dll
2008-01-21 22:24 75 --sh--r C:\WINDOWS\CT4CET.bin
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
----a-w 483,328 2004-12-14 10:12:02 C:\Program Files\Adobe\Acrobat 7.0\Distillr\bak\Acrotray.exe
----a-w 483,328 2006-01-13 03:52:32 C:\Program Files\Adobe\Acrobat 7.0\Distillr\AcroTray.exe
----a-w 67,112 2006-08-01 23:35:36 C:\Program Files\AIM\bak\aim.exe
----a-w 67,112 2006-08-01 23:35:36 C:\Program Files\AIM\aim.exe
----a-w 155,648 2006-01-13 00:40:44 C:\Program Files\Common Files\Ahead\Lib\bak\NeroCheck.exe
----a-w 53,408 2006-03-25 01:14:48 C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe
----a-w 241,664 2003-12-22 16:38:42 C:\Program Files\HP\hpcoretech\bak\hpcmpmgr.exe
----a-w 324 2008-04-12 07:47:44 C:\Program Files\HP\hpcoretech\bak\data\EvntData-543229842.xml
----a-w 49,263 2006-11-09 23:07:30 C:\Program Files\Java\jre1.5.0_10\bin\bak\jusched.exe
----a-w 282,624 2007-02-06 23:18:25 C:\Program Files\QuickTime\bak\qttask.exe
----a-w 286,720 2007-06-29 13:24:52 C:\Program Files\QuickTime\QTTask.exe
----a-w 124,656 2006-06-15 09:40:34 C:\Program Files\Symantec Client Security\Symantec AntiVirus\bak\VPTray.exe
----a-w 35,328 2006-06-21 17:14:50 C:\Program Files\Winamp\bak\winampa.exe
----a-w 15,360 2004-08-04 01:07:00 C:\WINDOWS\system32\bak\ctfmon.exe
----a-w 15,360 2004-08-04 01:07:00 C:\WINDOWS\system32\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5BA7292A-0FD9-4AA1-84A2-6A812D9AACA4}]
C:\WINDOWS\system32\tuvWnkIC.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 18:07 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-26 00:14 68856]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-04-21 18:03 94208]
"Creative Live! Cam Manager"="C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2007-06-07 15:01 155648]
"CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-11-17 02:42 53341]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-01-03 09:15 50528]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 11:37 2321600]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-12-15 13:01 5513216]
"CTHelper"="CTHELPER.EXE" [2006-08-11 15:56 17920 C:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-11 15:56 18944 C:\WINDOWS\system32\CTXFIHLP.EXE]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52 483328]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 14:22 3739648]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18 270648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"V0410Mon.exe"="C:\WINDOWS\V0410Mon.exe" [2007-06-06 18:00 32768]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-17 09:01 579584]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-11 16:00 219136]
C:\Documents and Settings\Edmund\Start Menu\Programs\Startup\
MEMonitor.lnk - C:\Program Files\Verizon Wireless\V CAST Music Manager\MEMonitor.exe [2007-11-14 21:28:13 947544]
C:\Documents and Settings\Annette\Start Menu\Programs\Startup\
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2008-02-16 16:14:02 106496]
Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2007-05-01 19:37:06 344064]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2007-01-23 19:12:59 25214]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-05-28 18:53:52 0]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"C:\\Program Files\\CyberLink\\PowerDirector\\PDR.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\LimeWire\\LimeWire.exe"=
R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe [2004-08-03 18:07]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 14:38]
R3 RLDesignVirtualAudioCableWdm;Live! Cam Virtual;C:\WINDOWS\system32\DRIVERS\livecamv.sys [2007-01-15 18:57]
S3 dpartmgr;dpartmgr;C:\DOCUME~1\Edmund\LOCALS~1\Temp\dpartmgr.sys []
S3 MA_CMIDI;%EVOL_USB.SvcDesc%;C:\WINDOWS\system32\drivers\ma_cmidi.sys [2005-06-14 13:44]
S3 V0410Afx;Creative Camera VF0410 Audio Effects Driver;C:\WINDOWS\system32\DRIVERS\V0410Afx.sys [2007-06-10 18:01]
S3 V0410Aud;Creative Camera VF0410 Noise Cancellation APO;C:\WINDOWS\system32\DRIVERS\V0410Aud.sys [2007-02-14 03:14]
S3 V0410Dev;Creative Camera VF0410 Driver;C:\WINDOWS\system32\DRIVERS\V0410Dev.sys [2007-07-03 18:00]
S3 V0410Vfx;Creative Camera VF0410 Video VFX Driver;C:\WINDOWS\system32\DRIVERS\V0410Vfx.sys [2006-12-04 22:37]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
"2008-05-31 00:15:00 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-05-28 19:02:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-05-28 07:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-28 16:00:00 C:\WINDOWS\Tasks\At10.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-28 17:00:00 C:\WINDOWS\Tasks\At11.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-28 18:00:00 C:\WINDOWS\Tasks\At12.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-30 19:00:00 C:\WINDOWS\Tasks\At13.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-30 20:00:00 C:\WINDOWS\Tasks\At14.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-30 21:00:00 C:\WINDOWS\Tasks\At15.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-30 22:00:00 C:\WINDOWS\Tasks\At16.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-30 23:00:00 C:\WINDOWS\Tasks\At17.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-31 00:00:00 C:\WINDOWS\Tasks\At18.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-31 01:00:00 C:\WINDOWS\Tasks\At19.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-28 08:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-31 02:00:00 C:\WINDOWS\Tasks\At20.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-31 03:00:03 C:\WINDOWS\Tasks\At21.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-31 04:00:01 C:\WINDOWS\Tasks\At22.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-31 05:00:00 C:\WINDOWS\Tasks\At23.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-31 06:00:00 C:\WINDOWS\Tasks\At24.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-30 09:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-26 10:00:00 C:\WINDOWS\Tasks\At4.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-20 11:00:00 C:\WINDOWS\Tasks\At5.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-20 12:00:00 C:\WINDOWS\Tasks\At6.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-20 13:00:00 C:\WINDOWS\Tasks\At7.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-20 14:00:00 C:\WINDOWS\Tasks\At8.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
"2008-05-20 15:00:00 C:\WINDOWS\Tasks\At9.job"
- C:\WINDOWS\system32\kQEMxr2y.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-30 23:47:04
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
.
**************************************************************************
.
Completion time: 2008-05-30 23:59:27 - machine was rebooted [Annette]
ComboFix-quarantined-files.txt 2008-05-31 06:59:25
Pre-Run: 186,639,589,376 bytes free
Post-Run: 187,571,957,760 bytes free
363
Thank you so very much in advance!!