ComboFix 08-11-09.04 - Marit 2008-11-11 22:07:15.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1044.18.1132 [GMT 1:00] Running from: c:\users\Marit\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2008-10-11 to 2008-11-11 ))))))))))))))))))))))))))))))) . 2008-11-11 20:59 . 2008-11-11 20:59 d-------- c:\users\All Users\Avira 2008-11-11 20:59 . 2008-11-11 20:59 d-------- c:\program files\Avira 2008-11-11 20:59 . 2008-11-11 20:59 d-------- c:\progra~2\Avira 2008-11-10 23:28 . 2008-11-10 23:28 d-------- c:\program files\Trend Micro 2008-11-10 23:05 . 2008-11-10 23:05 d-------- c:\users\Marit\AppData\Roaming\Malwarebytes 2008-11-10 23:05 . 2008-11-10 23:05 d-------- c:\users\All Users\Malwarebytes 2008-11-10 23:05 . 2008-11-10 23:05 d-------- c:\program files\Malwarebytes' Anti-Malware 2008-11-10 23:05 . 2008-11-10 23:05 d-------- c:\progra~2\Malwarebytes 2008-11-10 23:05 . 2008-10-22 16:10 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys 2008-11-10 23:05 . 2008-10-22 16:10 15,504 --a------ c:\windows\System32\drivers\mbam.sys 2008-11-10 22:55 . 2008-11-10 22:55 d-------- c:\program files\CCleaner 2008-11-07 14:43 . 2008-10-16 22:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll 2008-11-07 14:43 . 2008-10-16 21:56 1,524,736 --a------ c:\windows\System32\wucltux.dll 2008-11-07 14:43 . 2008-10-16 22:09 51,224 --a------ c:\windows\System32\wuauclt.exe 2008-11-07 14:43 . 2008-10-16 22:09 43,544 --a------ c:\windows\System32\wups2.dll 2008-11-07 14:42 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll 2008-11-07 14:42 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe 2008-11-02 00:29 . 2008-11-02 00:29 d-------- c:\program files\Folder Lock 2008-11-02 00:29 . 2002-12-25 09:44 380,928 --a------ c:\windows\System32\vaultskn.ocx 2008-11-02 00:29 . 2004-05-10 12:42 110,592 --a------ c:\windows\System32\suppdll.dll 2008-11-02 00:29 . 2007-02-07 19:50 77,824 --a------ c:\windows\System32\FLKill.exe 2008-11-02 00:29 . 2008-11-11 20:41 35,363 --a------ c:\windows\System32\windrvNT.sys 2008-11-02 00:29 . 1999-04-23 22:22 20,992 --a------ c:\windows\System32\hhopen.ocx 2008-10-29 20:18 . 2008-08-12 04:29 441,856 --a------ c:\windows\System32\win32spl.dll 2008-10-29 20:18 . 2008-08-12 04:29 37,376 --a------ c:\windows\System32\printcom.dll 2008-10-24 21:16 . 2008-08-06 04:27 1,244,672 --a------ c:\windows\System32\mcmde.dll 2008-10-24 21:16 . 2008-08-06 04:27 428,032 --a------ c:\windows\System32\EncDec.dll 2008-10-24 21:16 . 2008-08-06 04:27 292,352 --a------ c:\windows\System32\psisdecd.dll 2008-10-24 21:16 . 2008-08-06 04:26 217,088 --a------ c:\windows\System32\psisrndr.ax 2008-10-24 21:16 . 2008-08-06 04:26 177,152 --a------ c:\windows\System32\mpg2splt.ax 2008-10-24 21:16 . 2008-08-06 04:26 80,896 --a------ c:\windows\System32\MSNP.ax 2008-10-24 21:16 . 2008-08-06 04:26 68,608 --a------ c:\windows\System32\Mpeg2Data.ax 2008-10-24 21:16 . 2008-08-06 04:26 57,856 --a------ c:\windows\System32\MSDvbNP.ax 2008-10-17 17:24 . 2008-10-17 17:24 d-------- c:\program files\QuickTime . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-09 13:26 27,839 ----a-w c:\users\Marit\AppData\Roaming\nvModes.dat 2008-11-04 19:21 --------- d-----w c:\users\Marit\AppData\Roaming\LimeWire 2008-10-16 11:14 --------- d-----w c:\program files\Windows Mail 2008-10-16 11:13 --------- d-----w c:\progra~2\Microsoft Help 2008-10-02 03:49 826,368 ----a-w c:\windows\System32\wininet.dll 2008-10-02 03:49 56,320 ----a-w c:\windows\System32\iesetup.dll 2008-10-02 03:49 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll 2008-10-02 03:48 26,624 ----a-w c:\windows\System32\ieUnatt.exe 2008-09-18 04:35 3,505,208 ----a-w c:\windows\System32\ntkrnlpa.exe 2008-09-18 04:35 3,470,904 ----a-w c:\windows\System32\ntoskrnl.exe 2008-09-18 02:03 2,027,520 ----a-w c:\windows\System32\win32k.sys 2008-09-14 16:00 --------- d-----w c:\progra~2\Avg8 2008-07-10 10:15 174 --sha-w c:\program files\desktop.ini 2008-05-19 20:19 206 ----a-w c:\users\Marit\AppData\Roaming\wklnhst.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-05-20 1232896] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-12-14 102400] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 40048] "eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 457216] "eAudio"="c:\acer\Empowering Technology\eAudio\eAudio.exe" [2007-08-31 1286144] "NvSvc"="c:\windows\system32\nvsvc.dll" [2007-12-14 86016] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-14 8501792] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-14 81920] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-12-14 174616] "LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-01-02 707080] "PlayMovie"="c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-12-05 200704] "WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344] "PLFSet"="c:\windows\PLFSet.dll" [2007-04-25 45056] "Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-08-01 151552] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784] "Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe" [2008-01-29 583048] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "RtHDVCpl"="RtHDVCpl.exe" [2007-12-14 c:\windows\RtHDVCpl.exe] "Skytel"="Skytel.exe" [2007-12-14 c:\windows\SkyTel.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-08-01 151552] c:\users\Marit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper og Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440] c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\ Acer VCM.lnk - c:\program files\Acer\Acer VCM\AcerVCM.exe [2008-05-19 1216512] Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-05-25 113664] BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-03-29 719664] Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-12-22 535336] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{076EC745-F577-417A-9FAD-34F4387961C7}"= c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe "{EE7C081D-4161-49B8-9C96-1E4960D5DFC1}"= c:\program files\Acer Arcade Deluxe\VideoMagician\VideoMagician.exe:VideoMagician "{AEAC0F7A-ED71-4430-A83B-218DBA12596D}"= c:\program files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:HomeMedia "{BB5E7DE3-C0BE-4E97-99CA-E55AFAD63DBA}"= c:\program files\Acer Arcade Deluxe\DV Wizard\DV Wizard.exe:DV Wizard "{AB7579B6-2D46-4EC5-B27A-21B8D3DD542E}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{4AE25EAC-AE03-4218-B91C-BB46A722CCB6}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{A1A7109F-2D4C-44F2-B25F-05624B9C27DA}"= c:\program files\Acer Arcade Deluxe\DVDivine\DVDivine.exe:DVDivine "{21F02712-221B-43C3-BF73-6310662BE15B}"= c:\program files\Acer Arcade Deluxe\Play Movie\PlayMovie.exe:Play Movie "{6855ADF0-92C6-422C-9BD2-0CE1EDB2FE02}"= c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe:Play Movie Resident Program "{08A9A6C2-4FFE-42D6-AF1A-99210A1B7730}"= c:\program files\Acer\Acer VCM\VC.exe:Acer VCM "{585717D0-8BDA-495D-A325-2E1E8CCEB706}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{B3C7BA05-FC77-4FE1-ACB5-060C65424EF5}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{ACF0D6B2-16B3-44E2-B9F2-1C784EDFE23E}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{F1993CD6-E28F-48DD-90C2-8CBA291C5745}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System] "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic| R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\Play Movie\[u]0[/u]00.fcl [2007-12-05 09:48 41456] R2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [2007-09-28 233472] R3 winbondcir;Winbond IR Transceiver;c:\windows\system32\DRIVERS\winbondcir.sys [2007-12-14 43008] S3 A310;AVerMedia A310 DVB-T;c:\windows\system32\DRIVERS\AVerA310USB.sys [2007-07-10 26368] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-12-14 179712] S3 BDASwCap;AVerMedia A310 BDA DVBT Capture Device;c:\windows\system32\drivers\AVerA310Cap.sys [2007-07-10 42240] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{98a9d4dc-32fb-11dd-83ad-9e6b42cc1913}] \shell\AutoRun\command - E:\LaunchU3.exe -a *Newly Created Service* - AVGIO *Newly Created Service* - AVGNTFLT *Newly Created Service* - AVIPBB *Newly Created Service* - SSMDRV *Newly Created Service* - WINDRVNT . . ------- Supplementary Scan ------- . R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 R0 -: HKLM-Main,Start Page = hxxp://no.intl.acer.yahoo.com O8 -: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm O8 -: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 -: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 -: Send bilde til &Bluetooth-enhet... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 -: Send side til &Bluetooth-enhet... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-11 22:10:29 Windows 6.0.6000 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\sccfg.sys 20 bytes ************************************************************************** . Completion time: 2008-11-11 22:13:10 ComboFix-quarantined-files.txt 2008-11-11 21:12:04 ComboFix2.txt 2008-11-10 22:18:41 Pre-Run: 38 703 329 280 byte ledig Post-Run: 38,501,040,128 byte ledig 162 --- E O F --- 2008-11-05 14:52:19