Thread: Need help with my wife's laptop
View Single Post
•
•
Join Date: May 2007
Posts: 23
Reputation: kingt36 is an unknown quantity at this point 
Solved Threads: 0
kingt36 kingt36 is offline Offline
Newbie Poster

Re: Need help with my wife's laptop

 
0
  #4
Oct 6th, 2008
I noticed some other combofix logs that were much longer, so I ran it again. Here is the new log..

ComboFix 08-10-06.03 - Dee 2008-10-06 21:24:08.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.142 [GMT -4:00]
Running from: C:\Documents and Settings\Dee\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\WINDOWS\system32\awchnvvx.ini
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\nffbkxgb.ini
C:\WINDOWS\system32\npecivnd.ini
C:\WINDOWS\system32\obneutsg.ini

.
((((((((((((((((((((((((( Files Created from 2008-09-07 to 2008-10-07 )))))))))))))))))))))))))))))))
.

2008-10-06 12:19 . 2008-10-06 12:19 <DIR> d-------- C:\Documents and Settings\Dee\Application Data\Malwarebytes
2008-10-06 11:24 . 2008-10-06 12:04 <DIR> d-------- C:\Program Files\EsetOnlineScanner
2008-10-06 10:51 . 2008-10-06 10:51 <DIR> d-------- C:\Documents and Settings\Administrator.DEE\Application Data\Malwarebytes
2008-10-06 10:50 . 2008-10-06 10:51 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-06 10:50 . 2008-10-06 10:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-06 10:50 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-06 10:50 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-06 10:27 . 2008-10-06 10:27 <DIR> d-------- C:\Documents and Settings\Administrator.DEE
2008-10-06 01:26 . 2008-10-06 01:26 111,616 --a------ C:\WINDOWS\system32\vmchehdo.dll
2008-10-06 01:20 . 2008-10-06 01:20 103,936 --a------ C:\WINDOWS\system32\wvgddcyv.dll
2008-10-06 01:14 . 2008-10-06 01:14 111,616 --a------ C:\WINDOWS\system32\gtwaotly.dll
2008-10-04 16:43 . 2008-10-04 16:43 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-10-03 20:02 . 2008-10-05 04:16 <DIR> d-------- C:\WINDOWS\system32\EV19
2008-10-03 20:02 . 2008-10-03 20:02 <DIR> d-------- C:\Temp\xp34
2008-10-03 20:02 . 2008-10-03 20:03 <DIR> d-------- C:\Temp
2008-09-30 00:28 . 2008-09-30 00:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\64-07-46-2p-3p-r9
2008-09-27 11:38 . 2008-09-27 11:38 <DIR> d-------- C:\Program Files\Lavasoft
2008-09-27 11:38 . 2008-09-27 11:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-09-27 11:37 . 2008-09-27 11:37 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-25 23:39 . 2008-09-25 23:39 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-09-25 23:39 . 2008-09-25 23:39 <DIR> d-------- C:\WINDOWS\system32\en
2008-09-25 23:39 . 2008-09-25 23:39 <DIR> d-------- C:\WINDOWS\system32\bits
2008-09-25 23:39 . 2008-09-25 23:39 <DIR> d-------- C:\WINDOWS\l2schemas
2008-09-25 23:35 . 2008-09-25 23:40 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-09-25 23:26 . 2008-09-25 23:26 <DIR> d-------- C:\WINDOWS\EHome
2008-09-25 21:57 . 2008-10-06 01:53 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-09-25 21:57 . 2008-09-26 00:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-25 19:35 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-09-25 19:34 . 2008-09-25 19:34 <DIR> d-------- C:\Program Files\Panda Security
2008-09-25 18:40 . 2008-09-25 18:40 <DIR> d-------- C:\Documents and Settings\Administrator
2008-09-25 13:31 . 2008-09-26 12:24 1,825 --a------ C:\Documents and Settings\Dee\xl00365.exe
2008-09-20 16:25 . 2008-04-13 20:12 1,737,856 --a------ C:\WINDOWS\system32\mtxparhd.dll
2008-09-20 16:24 . 2004-08-03 22:41 1,041,536 --a------ C:\WINDOWS\system32\drivers\hsfdpsp2.sys
2008-09-20 16:23 . 2008-04-13 20:11 870,784 --a------ C:\WINDOWS\system32\ati3d1ag.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-06 21:21 --------- d-----w C:\Program Files\Trend Micro
2008-10-06 20:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-10-05 23:27 90,112 ----a-w C:\WINDOWS\DUMP4366.tmp
2008-10-02 17:46 --------- d-----w C:\Documents and Settings\Dee\Application Data\AdobeUM
2008-09-27 15:27 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-27 15:27 --------- d-----w C:\Program Files\HOTALBUMMyBOX
2008-09-27 15:22 --------- d-----w C:\Program Files\Dell
2008-09-27 15:20 --------- d-----w C:\Program Files\BitComet
2008-09-19 02:02 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-11 16:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-09-02 03:54 --------- d-----w C:\Program Files\WildGames
2008-09-02 03:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\WildTangent
2008-08-29 06:49 97,928 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-08-23 23:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\96-05-46-2p-3p-r9
2008-08-23 23:09 --------- d-----w C:\Program Files\KaPi_Monopoly
2008-08-23 23:03 10,520 ----a-w C:\WINDOWS\system32\avgrsstx.dll
2008-08-23 23:02 --------- d-----w C:\Program Files\AVG
2008-08-23 23:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8
2008-08-23 22:52 --------- d-----w C:\Program Files\Microsoft AntiSpyware
2008-08-23 06:38 --------- d-----w C:\Program Files\RealArcade
2008-08-23 06:37 --------- d-----w C:\Program Files\WildTangent
2008-08-23 05:18 --------- d-----w C:\Program Files\Monopolie
2008-08-23 04:13 --------- d-----w C:\Program Files\GameHouse
2008-08-23 04:13 --------- d-----w C:\Documents and Settings\Dee\Application Data\GameHouse
2008-08-23 04:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9
2008-08-16 06:28 --------- d-----w C:\Program Files\Shockwave.com
2008-08-15 23:05 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-07-19 02:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
2008-07-19 02:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-19 02:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-19 02:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2008-07-19 02:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-19 02:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-19 02:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
2008-07-19 02:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-19 02:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2008-07-19 02:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-19 02:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2008-07-19 02:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-19 02:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2008-07-19 02:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-19 02:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2008-07-19 02:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-19 02:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:26 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-26 68856]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-06-19 50528]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [X]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-01-31 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 32881]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-05 339968]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-09-01 684032]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-11-20 26112]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-24 282624]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 86016]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-09-25 229952]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-10-04 1234712]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-11-20 24576]
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-08-26 124912]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IncrediMail_Install.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\AIM6\\aim6.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23759:TCP"= 23759:TCP:BitComet 23759 TCP
"23759:UDP"= 23759:UDP:BitComet 23759 UDP
"3482:UDP"= 3482:UDP:Windows Media Format SDK (firefox.exe)
"3483:UDP"= 3483:UDP:Windows Media Format SDK (firefox.exe)
"3826:UDP"= 3826:UDP:Windows Media Format SDK (firefox.exe)
"3827:UDP"= 3827:UDP:Windows Media Format SDK (firefox.exe)
"4084:UDP"= 4084:UDP:Windows Media Format SDK (firefox.exe)
"4085:UDP"= 4085:UDP:Windows Media Format SDK (firefox.exe)

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544]
R0 PzWDM;PzWDM;C:\WINDOWS\system32\Drivers\PzWDM.sys [2008-04-22 15172]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-29 97928]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704]
R2 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-02-26 29183504]
R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S3 RkPavproc1;RkPavproc1;C:\WINDOWS\system32\drivers\RkPavproc1.sys [ ]
S3 samhid;samhid;C:\WINDOWS\system32\drivers\samhid.sys [2004-07-14 5068]
.
Contents of the 'Scheduled Tasks' folder

2008-09-16 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2006-09-19 18:36]

2008-10-06 C:\WINDOWS\Tasks\User_Feed_Synchronization-{59C1DE4B-9B09-44D9-AEAF-BBFF6C7517C9}.job
- C:\WINDOWS\system32\msfeedssync.exe [2007-08-13 19:36]
.
- - - - ORPHANS REMOVED - - - -

BHO-{4E583605-D8B0-49E6-8291-EB874413E92D} - (no file)
BHO-{88379D08-C9C1-4636-981D-EBCB315A9B8E} - (no file)
BHO-{EE86DA01-A709-437B-9D38-EECBCA46A02B} - (no file)
HKCU-Run-MsnMsgr - C:\Program Files\MSN Messenger\MsnMsgr.Exe
HKLM-Run-5092f358 - C:\WINDOWS\system32\dnvicepn.dll
ShellExecuteHooks-{88379D08-C9C1-4636-981D-EBCB315A9B8E} - (no file)


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Dee\Application Data\Mozilla\Firefox\Profiles\hpotonur.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.msn.com
FF -: plugin - C:\Documents and Settings\Dee\Application Data\Mozilla\Firefox\Profiles\hpotonur.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07076007.dll
FF -: plugin - C:\Program Files\Adobe\Acrobat 6.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\Google\Google Updater\2.2.940.34809\npCIDetect11.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.2_03\bin\NPJava11.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.2_03\bin\NPJava12.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.2_03\bin\NPJava13.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.2_03\bin\NPJava14.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.2_03\bin\NPJava32.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.2_03\bin\NPOJI610.dll
FF -: plugin - c:\Program Files\Microsoft Silverlight\2.0.30523.8\npctrl.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll
FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-06 21:29:15
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-10-06 21:32:07
ComboFix-quarantined-files.txt 2008-10-07 01:31:22

Pre-Run: 19,588,661,248 bytes free
Post-Run: 19,579,555,840 bytes free

208 --- E O F --- 2008-09-27 15:07:33
Reply With Quote