ComboFix 08-11-22.02 - Owner 2008-11-22 18:40:50.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1364 [GMT -7:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\windows\system32\TDSSmtve.dat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\TDSSmtve.dat

.
((((((((((((((((((((((((( Files Created from 2008-10-23 to 2008-11-23 )))))))))))))))))))))))))))))))
.

2008-11-22 14:13 . 2008-11-22 14:13 <DIR> d-------- c:\documents and settings\Owner\DoctorWeb
2008-11-22 13:39 . 2008-11-22 13:39 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-22 13:39 . 2008-11-22 13:39 <DIR> d-------- c:\documents and settings\Owner\Application Data\Malwarebytes
2008-11-22 13:39 . 2008-11-22 13:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-22 13:39 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-22 13:39 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-22 10:29 . 1998-06-24 13:00 244,024 --a------ c:\windows\system32\MSFLXGRD.OCX
2008-11-22 10:12 . 2008-11-22 10:13 <DIR> d-------- c:\documents and settings\Owner\Application Data\RegFixPro
2008-11-22 10:03 . 2008-11-22 10:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\ESET
2008-11-19 15:01 . 2008-11-19 15:01 <DIR> d-------- C:\cabs
2008-11-19 10:14 . 2008-11-19 10:14 <DIR> d-------- c:\program files\RivaTuner v2.11
2008-11-19 07:09 . 2008-11-21 10:15 <DIR> d-------- c:\program files\World of Warcraft
2008-11-12 11:18 . 2008-09-04 10:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-12 11:17 . 2008-10-24 04:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-11 19:03 . 2008-11-11 19:03 <DIR> d-------- C:\CFLog
2008-11-11 18:27 . 2008-11-11 18:27 <DIR> d-------- c:\program files\G4box
2008-11-10 12:50 . 2008-11-10 12:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\Blizzard
2008-11-08 17:40 . 2008-11-22 10:15 <DIR> d--h----- C:\$AVG8.VAULT$
2008-11-08 17:30 . 2008-11-22 14:30 <DIR> d-------- c:\windows\system32\drivers\Avg
2008-11-08 17:30 . 2008-11-08 17:30 <DIR> d-------- c:\program files\AVG
2008-11-08 17:30 . 2008-11-08 17:33 <DIR> d-------- c:\documents and settings\Owner\Application Data\AVGTOOLBAR
2008-11-08 17:30 . 2008-11-22 10:15 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2008-11-08 17:30 . 2008-11-08 17:30 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-11-08 17:30 . 2008-11-08 17:30 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
2008-11-08 17:30 . 2008-11-08 17:30 10,520 --a------ c:\windows\system32\avgrsstx.dll
2008-11-03 17:08 . 2008-11-03 17:08 <DIR> d-------- C:\AeriaGames
2008-11-01 14:33 . 2008-11-01 14:33 682,280 --a------ c:\windows\system32\pbsvc.exe
2008-10-29 04:31 . 2008-10-29 04:31 <DIR> d-------- C:\CrashRpt
2008-10-29 04:31 . 2008-10-29 04:31 <DIR> d-------- C:\CrashReport
2008-10-27 11:02 . 2008-10-27 11:02 <DIR> d-------- c:\program files\steam
2008-10-26 16:53 . 2008-10-26 16:50 102,664 --a------ c:\windows\system32\drivers\tmcomm.sys
2008-10-26 16:50 . 2008-10-26 16:53 <DIR> d-------- c:\documents and settings\Owner\.housecall6.6
2008-10-26 16:42 . 2008-10-26 16:42 <DIR> d-------- c:\program files\Trend Micro
2008-10-25 08:48 . 2008-10-25 08:48 <DIR> d-------- c:\program files\Valve
2008-10-25 08:19 . 2008-10-25 08:22 <DIR> d-------- c:\program files\Trymedia
2008-10-25 08:16 . 2008-10-26 13:58 <DIR> d-------- c:\program files\Atari-Infogrames
2008-10-24 06:02 . 2008-10-15 09:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-22 17:06 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-11-22 17:06 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-19 18:15 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
2008-11-19 13:05 --------- d-----w c:\program files\RivaTuner v2.09
2008-11-18 14:20 138,408 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-11-11 19:55 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-11 19:54 --------- d-----w c:\program files\Activision
2008-11-01 21:33 22,328 ----a-w c:\documents and settings\Owner\Application Data\PnkBstrK.sys
2008-10-25 19:43 --------- d-----w c:\documents and settings\Owner\Application Data\uTorrent
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-15 20:33 --------- d-----w c:\program files\Opera
2008-10-14 20:53 --------- d-----w c:\program files\Windows Defender
2008-10-14 16:35 --------- d-----w c:\program files\Avira
2008-10-14 16:35 --------- d-----w c:\documents and settings\All Users\Application Data\Avira
2008-10-10 22:30 --------- d-----w c:\program files\Triggersoft
2008-10-10 18:03 --------- d-----w c:\program files\Aeria Games
2008-10-10 00:41 --------- d-----w c:\program files\Lizard Interactive Co
2008-10-09 15:07 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2008-10-09 14:48 --------- d-----w c:\program files\Lavasoft
2008-10-09 14:47 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-10-08 14:31 --------- d-----w c:\documents and settings\Owner\Application Data\IGN_DLM
2008-10-07 22:59 --------- d-----w c:\program files\TuneUp Utilities 2008
2008-10-07 22:58 --------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2008-10-07 22:45 --------- d-----w c:\documents and settings\Owner\Application Data\TuneUp Software
2008-10-07 20:33 6,133,856 ----a-w c:\windows\system32\drivers\nv4_mini.sys
2008-10-02 00:35 --------- d-----w c:\program files\Outspark
2008-10-01 23:40 --------- d-----r c:\program files\Support.com
2008-10-01 23:37 --------- d-----w c:\program files\SupportSoft
2008-10-01 23:37 --------- d-----w c:\documents and settings\All Users\Application Data\Support.com
2008-09-20 02:52 703,257 ----a-w c:\windows\unins000.exe
2008-07-23 21:02 0 ----a-w c:\documents and settings\Owner\jagex_runescape_preferences.dat
2008-01-29 20:51 0 ----a-w c:\documents and settings\Owner\Application Data\wklnhst.dat
.

((((((((((((((((((((((((((((( snapshot@2008-11-22_17.23.40.46 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-11-23 01:46:53 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_118.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-12 68856]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 81920]
"igndlm.exe"="c:\program files\Download Manager\DLM.exe" [2008-08-01 1103216]
"Google Update"="c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-10-06 133104]
"Steam"="c:\program files\valve\steam\steam.exe" [2008-10-25 1410296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"AOL Spyware Protection"="c:\progra~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" [2004-03-19 78960]
"SunKistEM"="c:\program files\Digital Media Reader\shwiconem.exe" [2004-11-15 135168]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-03-09 966656]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-03 36352]
"tgcmd"="c:\program files\Support.com\bin\tgcmd.exe" [2005-11-18 1851392]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-08 1234712]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"CHotkey"="zHotkey.exe" [2004-05-17 c:\windows\zHotkey.exe]
"ShowWnd"="ShowWnd.exe" [2003-09-19 c:\windows\ShowWnd.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-12-01 c:\windows\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 c:\windows\LOGI_MWX.EXE]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 c:\windows\KHALMNPR.Exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 c:\windows\KHALMNPR.Exe]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
RivaTuner.lnk - c:\program files\RivaTuner v2.11\RivaTuner.exe [2008-09-16 2715648]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
BigFix.lnk - c:\program files\BigFix\BigFix.exe [2007-11-08 1742384]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2007-11-12 784912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2007-11-15 10:10 72208 c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Aspyr Media, Inc\\THAW\\Game\\THAW.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe"=
"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"=
"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe"=
"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe"=
"c:\\Program Files\\Atari-Infogrames\\Dead Man's Hand\\System\\DMH.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\sekjen\\source sdk base 2007\\hl2.exe"=
"c:\\Program Files\\Atari-Infogrames\\Dead Man's Hand\\System\\Udebugger.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\sekjen\\age of chivalry\\hl2.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\sekjen\\zombie panic! source\\hl2.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\left 4 dead demo\\left4dead.exe"=
"c:\\Program Files\\Valve\\Steam\\Steam.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"22114:TCP"= 22114:TCP:BitCometLite 22114 TCP
"22114:UDP"= 22114:UDP:BitCometLite 22114 UDP

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-03-31 78416]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-08 97928]
R1 nnrnstdi;nnrnstdi;c:\windows\system32\drivers\nnrnstdi.sys [2008-08-20 14336]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-03-31 20560]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-08 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-08 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-08 76040]
R2 Devx;Devx;c:\windows\system32\drivers\Devx.sys [2008-07-24 4448]
R2 npkcmsvc;npkcmsvc;c:\nexon\Mabinogi\npkcmsvc.exe [2008-02-02 80528]
R2 UxTuneUp;TuneUp Theme Extension;c:\windows\System32\svchost.exe -k netsvcs [2005-04-13 14336]
R2 VtPr;VtPr;c:\windows\system32\drivers\VtPr.sys [2008-07-24 3328]
R3 CCCP106;CIF USB Camera (2110A);c:\windows\system32\DRIVERS\cccp106.sys [2007-12-02 227200]
R3 km_filter;km_filter;c:\windows\system32\drivers\km_filter.sys [2008-08-20 8832]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys [2008-11-22 38496]
S3 RIOXDRV;SONICblue Rio generic driver XP+;c:\windows\system32\Drivers\RIOXDRV.sys [2008-08-01 18304]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;c:\windows\System32\TuneUpDefragService.exe [2008-10-07 354560]
S3 XDva008;XDva008; []
S3 XDva019;XDva019; []
S3 XDva037;XDva037; []
S3 XDva076;XDva076; []
S3 XDva132;XDva132; []
S3 XDva164;XDva164; []
S3 XDva201;XDva201; []
S3 XDva207;XDva207; []
S3 XDva208;XDva208; []

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\Installer.exe
.
Contents of the 'Scheduled Tasks' folder

2008-11-23 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-04-16 08:59]

2008-11-22 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-10-06 08:40]

2008-11-23 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]

2008-11-22 c:\windows\Tasks\RegFixPro Scheduled Scan.job
- c:\program files\RegFixPro\RegFixPro.exe []

2008-11-22 c:\windows\Tasks\RegFixPro Scheduled Scan.job
- c:\program files\RegFixPro []
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-22 18:46:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\windows\TEMP\TMP0000002F128F34CA5AB9F56B 524288 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(592)
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Windows Defender\MsMpEng.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\windows\ehome\ehRecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\NVIDIA Corporation\nTune\nTuneService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\dllhost.exe
c:\windows\ehome\ehmsas.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
.
**************************************************************************
.
Completion time: 2008-11-22 18:53:10 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-23 01:53:04
ComboFix2.txt 2008-11-23 00:24:14

Pre-Run: 73,314,156,544 bytes free
Post-Run: 73,316,614,144 bytes free

260 --- E O F --- 2008-11-21 12:23:46