requested report...
ComboFix 09-09-13.05 - g0n4rch 09/14/2009 1:36.1.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.894.542 [GMT -4:00]
Running from: c:\documents and settings\g0n4rch\Desktop\Combo-Fix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\_000110_.tmp.dll
c:\windows\system32\drivers\UACwwostjexuf.sys
c:\windows\system32\oem34.inf
c:\windows\system32\UACcjqftappen.dll
c:\windows\system32\UACdpxyvjooyu.dll
c:\windows\system32\UACfxcdqlkbes.dat
c:\windows\system32\uacinit.dll
c:\windows\system32\UACrqekvptnkb.dll
c:\windows\system32\uactmp.db
c:\windows\system32\UACwrwblovujd.db
c:\windows\system32\UACxhkwpibsiu.dll
c:\windows\system32\UACxrdugbivkb.dll
D:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_UACd.sys
-------\Legacy_UACd.sys
((((((((((((((((((((((((( Files Created from 2009-08-14 to 2009-09-14 )))))))))))))))))))))))))))))))
.
2009-09-10 22:59 . 2009-09-10 22:59 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\AVG Security Toolbar
2009-09-10 22:55 . 2009-09-10 23:00 -------- d-----w- c:\program files\SBSD
2009-09-10 22:39 . 2009-09-10 22:39 -------- d-----w- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2009-09-10 22:39 . 2009-09-10 22:39 -------- d-----w- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-09-10 22:06 . 2009-09-10 22:06 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2009-09-10 22:06 . 2009-09-10 22:06 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-09-10 21:49 . 2009-09-10 21:49 -------- d-----w- c:\documents and settings\g0n4rch\Local Settings\Application Data\AVG Security Toolbar
2009-09-10 14:15 . 2001-08-18 02:36 8704 ----a-w- c:\windows\system32\kbdjpn.dll
2009-09-10 14:15 . 2001-08-18 02:36 8704 ----a-w- c:\windows\system32\dllcache\kbdjpn.dll
2009-09-10 14:15 . 2001-08-18 02:36 8192 ----a-w- c:\windows\system32\kbdkor.dll
2009-09-10 14:15 . 2001-08-18 02:36 8192 ----a-w- c:\windows\system32\dllcache\kbdkor.dll
2009-09-10 14:15 . 2001-08-17 18:55 6144 ----a-w- c:\windows\system32\kbd101c.dll
2009-09-10 14:15 . 2001-08-17 18:55 6144 ----a-w- c:\windows\system32\dllcache\kbd101c.dll
2009-09-10 14:15 . 2001-08-17 18:55 5632 ----a-w- c:\windows\system32\kbd103.dll
2009-09-10 14:15 . 2001-08-17 18:55 5632 ----a-w- c:\windows\system32\dllcache\kbd103.dll
2009-09-10 14:15 . 2008-04-14 00:09 6144 ----a-w- c:\windows\system32\kbd106.dll
2009-09-10 14:15 . 2008-04-14 00:09 6144 ----a-w- c:\windows\system32\dllcache\kbd106.dll
2009-09-10 14:15 . 2001-08-17 18:55 6144 ----a-w- c:\windows\system32\kbd101b.dll
2009-09-10 14:15 . 2001-08-17 18:55 6144 ----a-w- c:\windows\system32\dllcache\kbd101b.dll
2009-09-09 21:59 . 2009-09-10 03:21 -------- d-----w- C:\$AVG8.VAULT$
2009-09-09 21:54 . 2009-09-09 21:54 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-09-09 21:54 . 2009-09-09 21:54 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-09-09 21:54 . 2009-09-09 21:54 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-09-09 21:54 . 2009-09-09 21:54 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-09-09 21:54 . 2009-09-13 22:08 -------- d-----w- c:\windows\system32\drivers\Avg
2009-09-09 21:54 . 2009-09-09 22:49 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-09-09 21:53 . 2009-09-09 22:46 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-09-09 21:53 . 2009-09-09 21:53 -------- d-----w- c:\program files\AVG
2009-09-09 21:43 . 2009-09-09 21:43 -------- d-----w- c:\documents and settings\g0n4rch\Application Data\AVG8
2009-09-09 21:24 . 2009-09-09 21:24 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-09-09 20:49 . 2009-09-09 20:49 -------- d-sh--w- c:\documents and settings\g0n4rch\PrivacIE
2009-09-09 20:49 . 2009-09-09 20:49 -------- d-sh--w- c:\documents and settings\g0n4rch\IECompatCache
2009-09-09 20:45 . 2009-09-09 20:45 -------- d-sh--w- c:\documents and settings\g0n4rch\IETldCache
2009-09-09 20:43 . 2009-08-07 08:48 100352 ------w- c:\windows\system32\dllcache\iecompat.dll
2009-09-09 20:42 . 2009-09-09 20:42 -------- d-----w- c:\windows\ie8updates
2009-09-09 20:41 . 2009-07-03 17:09 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2009-09-09 20:41 . 2009-07-03 17:09 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll
2009-09-09 20:39 . 2009-09-09 20:41 -------- dc-h--w- c:\windows\ie8
2009-09-09 20:31 . 2009-09-09 20:31 -------- d-----w- c:\windows\system32\XPSViewer
2009-09-09 20:31 . 2009-09-09 20:31 -------- d-----w- c:\program files\MSBuild
2009-09-09 20:31 . 2009-09-09 20:31 -------- d-----w- c:\program files\Reference Assemblies
2009-09-09 20:31 . 2008-07-06 12:06 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-09-09 20:31 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-09-09 20:31 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-09-09 20:31 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-09-09 20:31 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll
2009-09-09 20:31 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-09-09 20:31 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-09-09 20:31 . 2009-09-09 20:31 -------- d-----w- C:\02dc2933d0786ed65468ec
2009-09-09 20:03 . 2009-06-21 21:44 153088 ------w- c:\windows\system32\dllcache\triedit.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-13 23:31 . 2006-08-20 10:40 69104 ----a-w- c:\documents and settings\g0n4rch\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-10 23:00 . 2007-06-06 02:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-06 02:45 . 2006-11-18 01:07 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2009-08-05 09:01 . 2004-08-04 08:00 204800 ------w- c:\windows\system32\mswebdvd.dll
2009-07-17 19:01 . 2004-08-04 08:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 03:43 . 2004-08-04 08:00 286208 ------w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2004-08-04 08:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-25 08:25 . 2004-08-04 08:00 730112 ------w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2004-08-04 08:00 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2004-08-04 08:00 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2004-08-04 08:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:25 . 2004-08-04 08:00 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2004-08-04 08:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-24 11:18 . 2004-08-04 08:00 92928 ------w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:36 . 2004-08-04 08:00 81920 ------w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 08:00 119808 ------w- c:\windows\system32\t2embed.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-07-24 13:55 1090816 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-07-14 344064]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 1015808]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-11-16 503808]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2005-12-22 405504]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-02-17 233534]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-08-22 102400]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-09-09 2007832]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-09-09 21:54 11952 ----a-w- c:\windows\system32\avgrsstx.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Schedule"=2 (0x2)
"RDSessMgr"=3 (0x3)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)
"LiveUpdate"=3 (0x3)
"LightScribeService"=2 (0x2)
"IDriverT"=3 (0x3)
"hpqwmiex"=2 (0x2)
"hpqwmi"=3 (0x3)
"helpsvc"=2 (0x2)
"FastUserSwitchingCompatibility"=3 (0x3)
"ERSvc"=2 (0x2)
"comHost"=3 (0x3)
"PnkBstrB"=3 (0x3)
"PnkBstrA"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [9/9/2009 5:54 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [9/9/2009 5:54 PM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [9/9/2009 5:53 PM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [9/9/2009 5:53 PM 297752]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [12/15/2004 11:18 AM 231424]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=presario&pf=laptop
FF - ProfilePath - c:\documents and settings\g0n4rch\Application Data\Mozilla\Firefox\Profiles\z8haqrqa.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - about:blank
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p=
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2009-09-14 01:43
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe??????????Z?n??|?????? ???B?????????????hLC? ??????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(628)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-09-14 1:46
ComboFix-quarantined-files.txt 2009-09-14 05:45
Pre-Run: 13,287,399,424 bytes free
Post-Run: 16,241,147,904 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
224 --- E O F --- 2009-09-13 21:54