espengrande

<SUPERAntiSpyware Scan Log

http://www.superantispyware.com

 

Generated 01/20/2008 at 08:06 PM

 

Application Version : 3.9.1008

 

Core Rules Database Version : 3384

Trace Rules Database Version: 1378

 

Scan type : Complete Scan

Total Scan Time : 07:23:04

 

Memory items scanned : 416

Memory threats detected : 0

Registry items scanned : 6547

Registry threats detected : 0

File items scanned : 318618

File threats detected : 6

 

Browser Hijacker.Favorites

C:\MY OLD DISK STRUCTURE -- 16-07-07 2101\DOCUMENTS AND SETTINGS\ALL USERS\START MENU\SECURITY TROUBLESHOOTING.URL

 

Adware.Tracking Cookie

C:\My old Disk Structure -- 16-07-07 2101\Documents and Settings\Espen Gran\Cookies\[email protected][1].txt

C:\My old Disk Structure -- 16-07-07 2101\Documents and Settings\Espen Gran\Cookies\espen_grande@azjmp[1].txt

C:\My old Disk Structure -- 16-07-07 2101\Documents and Settings\Espen Gran\Cookies\espen_grande@cpvfeed[2].txt

C:\My old Disk Structure -- 16-07-07 2101\Documents and Settings\Espen Gran\Cookies\[email protected][2].txt

C:\My old Disk Structure -- 16-07-07 2101\Documents and Settings\Espen Gran\Cookies\[email protected][1].txt

>

<ComboFix 08-01-20.1 - Espen Grande 2008-01-20 21:52:35.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1335 [GMT 1:00]

Running from: C:\Documents and Settings\Espen Grande\Desktop\ComboFix.exe

* Created a new restore point

 

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft\Network\Downloader\qmgr0.dat

C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft\Network\Downloader\qmgr1.dat

C:\WINDOWS\svchost.exe

C:\WINDOWS\system32\hgggeca.dll

C:\WINDOWS\system32\iifgdeb.dll

C:\WINDOWS\system32\rqroooo.dll

C:\WINDOWS\system32\vtssrom.dll

C:\WINDOWS\system32\vtusttt.dll

 

----- Unknown downloads made by BITS: ----

http:/

.

((((((((((((((((((((((((( Files Created from 2007-12-20 to 2008-01-20 )))))))))))))))))))))))))))))))

.

 

2008-01-20 12:34 . 2008-01-20 12:34 <DIR> d-------- C:\Program Files\CCleaner

2008-01-20 12:31 . 2008-01-20 21:46 <DIR> d-------- C:\Program Files\SUPERAntiSpyware

2008-01-20 12:31 . 2008-01-20 12:31 <DIR> d-------- C:\Documents and Settings\Espen Grande\Application Data\SUPERAntiSpyware.com

2008-01-20 12:31 . 2008-01-20 12:31 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com

2008-01-20 12:31 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe

2008-01-20 12:30 . 2008-01-20 12:30 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard

2008-01-20 11:46 . 2008-01-20 11:46 <DIR> d-------- C:\Program Files\MSBuild

2008-01-20 11:42 . 2008-01-20 11:42 <DIR> d-------- C:\WINDOWS\system32\XPSViewer

2008-01-20 11:41 . 2008-01-20 11:41 <DIR> d-------- C:\Program Files\Reference Assemblies

2008-01-20 11:39 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll

2008-01-20 11:38 . 2008-01-20 11:38 <DIR> d-------- C:\Program Files\MSXML 6.0

2008-01-20 11:35 . 2004-08-03 23:10 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys

2008-01-20 11:35 . 2004-08-03 23:10 85,376 --a--c--- C:\WINDOWS\system32\dllcache\nabtsfec.sys

2008-01-20 11:35 . 2004-08-03 23:10 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS

2008-01-20 11:35 . 2004-08-03 23:10 19,328 --a--c--- C:\WINDOWS\system32\dllcache\wstcodec.sys

2008-01-20 11:35 . 2004-08-03 23:10 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys

2008-01-20 11:35 . 2004-08-03 23:10 17,024 --a--c--- C:\WINDOWS\system32\dllcache\ccdecode.sys

2008-01-20 11:34 . 2004-08-04 00:56 90,624 --a------ C:\WINDOWS\system32\kswdmcap.ax

2008-01-20 11:34 . 2004-08-04 00:56 90,624 --a--c--- C:\WINDOWS\system32\dllcache\kswdmcap.ax

2008-01-20 11:34 . 2004-08-04 00:56 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax

2008-01-20 11:34 . 2004-08-04 00:56 61,952 --a--c--- C:\WINDOWS\system32\dllcache\kstvtune.ax

2008-01-20 11:34 . 2004-08-04 00:56 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll

2008-01-20 11:34 . 2004-08-04 00:56 53,760 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll

2008-01-20 11:34 . 2004-08-04 00:56 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax

2008-01-20 11:34 . 2004-08-04 00:56 43,008 --a--c--- C:\WINDOWS\system32\dllcache\ksxbar.ax

2008-01-20 11:34 . 2004-08-04 00:56 28,672 --a------ C:\WINDOWS\system32\vidcap.ax

2008-01-20 11:34 . 2004-08-04 00:56 28,672 --a--c--- C:\WINDOWS\system32\dllcache\vidcap.ax

2008-01-20 11:30 . 2006-11-13 07:02 288,768 --------- C:\WINDOWS\system32\rhttpaa.dll

2008-01-20 11:30 . 2006-11-13 07:02 116,736 --------- C:\WINDOWS\system32\aaclient.dll

2008-01-20 11:30 . 2006-11-13 07:02 36,352 --------- C:\WINDOWS\system32\tsgqec.dll

2008-01-19 21:43 . 2008-01-20 09:42 55,808 --------- C:\is151296.exe

2008-01-19 18:21 . 2008-01-19 18:21 <DIR> d-------- C:\Program Files\uTorrent

2008-01-11 19:00 . 2004-08-10 13:00 539,136 --a--c--- C:\WINDOWS\system32\dllcache\dialer.exe

2008-01-11 19:00 . 2004-08-10 13:00 538,624 --a------ C:\WINDOWS\system32\spider.exe

2008-01-11 19:00 . 2004-08-10 13:00 538,624 --a--c--- C:\WINDOWS\system32\dllcache\spider.exe

2008-01-11 19:00 . 2004-11-17 18:41 347,136 --a------ C:\WINDOWS\system32\hypertrm.dll

2008-01-11 19:00 . 2004-08-10 13:00 343,040 --a------ C:\WINDOWS\system32\mspaint.exe

2008-01-11 19:00 . 2004-08-10 13:00 343,040 --a--c--- C:\WINDOWS\system32\dllcache\mspaint.exe

2008-01-11 19:00 . 2004-08-10 13:00 102,912 --a--c--- C:\WINDOWS\system32\dllcache\clipbrd.exe

2008-01-11 19:00 . 2004-08-10 13:00 102,912 --a------ C:\WINDOWS\system32\clipbrd.exe

2008-01-02 19:26 . 2008-01-02 19:26 <DIR> d-------- C:\Program Files\Microsoft Plus! Digital Media Edition

2007-12-30 19:19 . 2007-12-30 19:19 <DIR> d-------- C:\Program Files\Windows Media Connect 2

2007-12-30 19:17 . 2007-12-30 19:17 <DIR> d-------- C:\WINDOWS\system32\xlive

2007-12-30 19:17 . 2007-12-31 15:01 <DIR> d-------- C:\WINDOWS\system32\LogFiles

2007-12-30 19:17 . 2007-12-30 19:18 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF

2007-12-30 19:17 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll

2007-12-30 19:17 . 2007-03-12 16:42 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll

2007-12-30 19:17 . 2007-03-15 16:57 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll

2007-12-30 19:17 . 2007-04-04 18:53 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll

2007-12-30 19:03 . 2007-12-30 19:03 <DIR> d-------- C:\Program Files\Microsoft Silverlight

2007-12-30 18:55 . 2004-08-10 13:00 114,688 --a--c--- C:\WINDOWS\system32\dllcache\calc.exe

2007-12-30 18:55 . 2004-08-10 13:00 114,688 --a------ C:\WINDOWS\system32\calc.exe

2007-12-28 18:51 . 2007-12-28 18:51 <DIR> d-------- C:\Documents and Settings\Espen Grande\Application Data\Corel

2007-12-28 18:51 . 2008-01-03 22:09 2,828 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys

2007-12-28 18:51 . 2008-01-03 21:50 88 -r-hs---- C:\WINDOWS\system32\7DB6786B60.sys

2007-12-28 18:50 . 2007-12-28 18:50 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Corel

2007-12-28 18:46 . 2007-12-28 18:48 <DIR> d-------- C:\Program Files\Common Files\Corel

2007-12-28 18:41 . 2007-12-28 18:46 <DIR> d-------- C:\Program Files\Corel

2007-12-28 18:41 . 2007-12-28 18:41 <DIR> d-------- C:\Documents and Settings\Espen Grande\Application Data\InstallShield

2007-12-28 18:38 . 2007-12-30 21:28 <DIR> d-------- C:\Program Files\IrfanView

2007-12-26 19:58 . 2007-12-26 19:58 <DIR> d-------- C:\Documents and Settings\Espen Grande\Application Data\InterVideo

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-01-20 11:30 --------- d-----w C:\Program Files\Trend Micro

2008-01-20 10:34 --------- d-----w C:\Program Files\LogMeIn

2008-01-20 10:33 --------- d-----w C:\Documents and Settings\Espen Grande\Application Data\uTorrent

2008-01-19 17:31 --------- d-----w C:\Program Files\BitLord

2008-01-15 18:41 --------- d-----w C:\Program Files\DivX

2008-01-13 20:54 --------- d-----w C:\Documents and Settings\Espen Grande\Application Data\dvdcss

2008-01-13 14:10 --------- d-----w C:\Documents and Settings\Espen Grande\Application Data\LimeWire

2008-01-09 02:07 --------- d-----w C:\Documents and Settings\Espen Grande\Application Data\Azureus

2007-12-27 21:31 --------- d-----w C:\Program Files\Winamp

2007-12-27 19:07 --------- d-----w C:\Documents and Settings\Espen Grande\Application Data\Apple Computer

2007-12-27 18:53 --------- d-----w C:\Program Files\iTunes

2007-12-26 21:06 --------- d-----w C:\Documents and Settings\Espen Grande\Application Data\Hamachi

2007-12-26 18:10 --------- d-----w C:\Documents and Settings\Espen Grande\Application Data\Ulead Systems

2007-12-24 12:12 --------- d-----w C:\Program Files\Azureus

2007-12-09 20:18 --------- d-----w C:\Program Files\CD to MP3 Ripper

2007-11-25 18:57 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys

2007-11-25 16:40 --------- d-----w C:\Program Files\EA GAMES

2007-11-04 20:18 37,232 ----a-w C:\Documents and Settings\Grande Family\Application Data\GDIPFONTCACHEV1.DAT

2007-09-04 11:31 36,832 ----a-w C:\Documents and Settings\Espen Grande\Application Data\GDIPFONTCACHEV1.DAT

2007-08-28 19:33 812 ----a-w C:\Program Files\INSTALL.LOG

.

<pre>
----a-w		 1,962,268 2006-01-03 16:15:38  C:\@Sft`s\Evidence Eliminator +\Evidence Eliminator v5.058 Upgrade .exe
</pre>

 

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 20:00 15360]

"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [ ]

"OE"="C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe" [2007-03-07 20:23 321040]

"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06 1318912]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 14:56 64512]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 22:43 8466432]

"nwiz"="nwiz.exe" [2007-06-28 22:43 1626112 C:\WINDOWS\system32\nwiz.exe]

"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe" [2007-03-07 20:19 3429904]

"SpyHunter"="C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe" [2007-04-26 14:04 2951296]

"P17Helper"="P17.dll" [2005-10-21 02:12 64512 C:\WINDOWS\system32\P17.dll]

"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-10 23:00 90112]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50 155648]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]

"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 22:48 479232]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 04:24 286720]

"Ulead AutoDetector v2"="C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2004-11-26 09:43 90112]

"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 15:34 213936]

"UVS10 Preload"="C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe" [2006-03-06 22:52 36864]

"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-28 22:43 81920]

"LogMeIn GUI"="C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [2007-04-17 12:03 63048]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" [2005-06-03 02:52 36975]

"Corel Photo Downloader"="C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2007-08-16 12:00 531272]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 20:00 15360]

 

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\

Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-12 23:01:04 83360]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles

"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]

LMIinit.dll 2007-11-21 19:11 87352 C:\WINDOWS\system32\LMIinit.dll

 

R0 viaagp;VIA AGP Bus Filter;C:\WINDOWS\system32\DRIVERS\viaagp.sys [2004-08-04 00:07]

R2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files\LogMeIn\x86\RaInfo.sys [2007-04-17 12:00]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2007-04-05 09:55]

R2 RVIEG01;VSC Engine;C:\Program Files\Roland\Virtual Sound Canvas DXi\RVIEg01.sys [2001-04-13 17:16]

R3 L6PODLV;PODxt Live Service;C:\WINDOWS\system32\Drivers\L6PODLV.sys [2007-09-17 20:25]

R3 SMCWPCIT;SMCWPCIT-G 108Mbps Wireless PCI adapter Service;C:\WINDOWS\system32\DRIVERS\SMCWPCIT.sys [2005-04-20 10:53]

S3 cxbu0wdm;CardMan 3x21;C:\WINDOWS\system32\DRIVERS\cxbu0wdm.sys [2007-02-28 06:38]

 

.

**************************************************************************

 

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-01-20 22:27:03

Windows 5.1.2600 Service Pack 2 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

Completion time: 2008-01-20 22:35:09 - machine was rebooted [Espen Grande]

ComboFix-quarantined-files.txt 2008-01-20 21:35:01

.

2008-01-09 02:02:05 --- E O F ---

 

 

 

>

<Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:39:39, on 20.01.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\LogMeIn\x86\RaMaint.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\LogMeIn\x86\LogMeIn.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

C:\WINDOWS\system32\PSIService.exe

C:\WINDOWS\system32\svchost.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\WINDOWS\system32\dllhost.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe

C:\WINDOWS\ehome\ehtray.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe

C:\WINDOWS\system32\Rundll32.exe

C:\Program Files\Google\Gmail Notifier\gnotify.exe

C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"

O4 - HKLM\..\Run: [spyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe

O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe

O4 - HKLM\..\Run: [iSUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler

O4 - HKLM\..\Run: [uVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe"

O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9

O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

O15 - Trusted Zone: http://www.puretna.com

O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1133169979437

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1184652743890

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe

O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe

O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

 

--

End of file - 9689 bytes>

<********************************* ROOTCHK-(28-12-07)-LOG, by ejvindh

20.01.2008 22:41:39,59

 

The rootkits that are detected by this tool were not found.

 

********************************* ROOTCHK-LOG-end

 

 

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-01-20 22:41:41

Windows 5.1.2600 Service Pack 2

scanning hidden processes ...

 

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\CfgJf40]

"khjeh"=hex:20,02,00,00,7b,eb,68,93,f7,95,66,02,c7,d5,2d,17,07,05,3d,0b,83,..

"hj34z0"=hex:0b,87,d9,cd,68,88,3b,63,26,48,2a,7f,17,e5,70,bf,b5,66,d5,1f,6e,..

"hj34z1"=hex:c9,87,d9,cd,10,88,3b,63,27,48,2b,7f,16,e5,70,bf,b5,66,d5,1f,8c,..

"hj34z2"=hex:c9,87,d9,cd,10,88,3b,63,27,48,2b,7f,16,e5,70,bf,b5,66,d5,1f,8c,..

"hj34z3"=hex:c9,87,d9,cd,10,88,3b,63,27,48,2b,7f,16,e5,70,bf,b5,66,d5,1f,8c,..

"hj34z4"=hex:c9,87,d9,cd,10,88,3b,63,27,48,2b,7f,16,e5,70,bf,b5,66,d5,1f,8c,..

 

scanning hidden registry entries ...

 

scanning hidden files ...

 

hidden processes: 0

hidden services: 0

hidden files: 0

 

>