ComboFix 09-09-25.01 - admin 09/27/2009 14:51.1.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.1023.400 [GMT -5:00]
Running from: c:\users\admin\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\gamevance\gamevancelib32.dll
c:\program files\Gamevance\gvtl.dll
.
((((((((((((((((((((((((( Files Created from 2009-08-27 to 2009-09-27 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-09-27 20:04 . 2009-07-01 01:26 680 ----a-w- c:\users\admin\AppData\Local\d3d9caps.dat
2009-09-27 20:01 . 2009-09-22 01:32 -------- d-----w- c:\program files\Gamevance
2009-09-26 05:46 . 2009-09-26 05:46 -------- d-----w- c:\users\admin\AppData\Roaming\IObit
2009-09-26 05:46 . 2009-09-26 05:46 -------- d-----w- c:\program files\IObit
2009-09-26 01:09 . 2009-09-26 01:09 -------- d-----w- c:\users\admin\AppData\Roaming\AVG8
2009-09-20 04:18 . 2009-07-02 17:27 1 ----a-w- c:\users\admin\AppData\Roaming\OpenOffice.org\3\us er\uno_packages\cache\stamp.sys
2009-09-19 04:09 . 2009-09-19 04:09 -------- d-----w- c:\program files\Google
2009-09-14 19:41 . 2009-09-14 19:33 -------- d-----w- c:\programdata\Comodo
2009-09-14 19:36 . 2009-09-14 19:36 -------- d-----w- c:\program files\Trend Micro
2009-09-14 19:33 . 2009-09-14 19:33 -------- d-----w- c:\program files\COMODO
2009-09-14 19:33 . 2009-09-14 19:33 74328 ----a-w- c:\windows\system32\drivers\inspect.sys
2009-09-14 19:33 . 2009-09-14 19:33 29520 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2009-09-14 19:33 . 2009-09-14 19:33 179792 ----a-w- c:\windows\system32\guard32.dll
2009-09-14 19:33 . 2009-09-14 19:33 128888 ----a-w- c:\windows\system32\drivers\cmdguard.sys
2009-09-14 19:19 . 2009-09-14 19:19 -------- d-----w- c:\program files\CCleaner
2009-09-14 19:15 . 2009-07-01 05:46 -------- d-----w- c:\program files\Burn4Free Toolbar
2009-09-14 19:14 . 2009-07-25 23:27 -------- d-----w- c:\program files\Yahoo!
2009-09-14 19:12 . 2009-09-14 19:12 -------- d-----w- c:\users\admin\AppData\Roaming\Malwarebytes
2009-09-14 19:12 . 2009-09-14 19:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-14 19:12 . 2009-09-14 19:12 -------- d-----w- c:\programdata\Malwarebytes
2009-09-10 19:54 . 2009-09-14 19:12 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 19:53 . 2009-09-14 19:12 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-10 17:31 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-08-31 22:37 . 2009-07-01 05:34 -------- d-----w- c:\program files\Java
2009-08-29 00:27 . 2009-09-14 19:03 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 00:14 . 2009-09-14 19:03 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-19 04:00 . 2009-08-19 04:00 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_NuidFltr_0 1005.Wdf
2009-08-14 18:50 . 2009-08-14 18:50 -------- d-----w- c:\program files\Microsoft IntelliPoint
2009-08-14 18:48 . 2009-08-14 18:48 -------- d-----w- c:\program files\Microsoft IntelliType Pro
2009-08-14 16:27 . 2009-09-09 18:49 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 15:53 . 2009-09-09 18:49 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 13:49 . 2009-09-09 18:49 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 13:49 . 2009-09-09 18:49 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 13:49 . 2009-09-09 18:49 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 13:49 . 2009-09-09 18:49 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 13:49 . 2009-09-09 18:49 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 13:49 . 2009-09-09 18:49 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 13:49 . 2009-09-09 18:49 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-14 13:48 . 2009-09-09 18:49 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-08-14 13:48 . 2009-09-09 18:49 105984 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-06 16:56 . 2009-07-25 23:45 -------- d-----w- c:\users\admin\AppData\Roaming\HP
2009-08-06 16:55 . 2009-08-06 16:40 176399 ----a-w- c:\windows\hpwins19.dat
2009-08-06 16:47 . 2009-08-06 16:47 -------- d-----w- c:\programdata\HP Product Assistant
2009-08-06 16:47 . 2009-07-02 17:06 -------- d-----w- c:\programdata\HP
2009-08-06 16:43 . 2009-08-06 16:43 -------- d-----w- c:\program files\Common Files\HP
2009-08-06 16:43 . 2009-08-06 16:43 -------- d-----w- c:\program files\Hewlett-Packard
2009-08-06 16:41 . 2009-07-02 17:08 -------- d-----w- c:\program files\HP
2009-07-25 23:36 . 2009-07-25 23:35 116840 ----a-w- c:\windows\hpqins00.dat
2009-07-25 10:23 . 2009-07-01 05:35 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-21 21:52 . 2009-07-30 15:31 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-30 15:31 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-30 15:31 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-30 15:31 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-17 13:54 . 2009-08-12 18:40 71680 ----a-w- c:\windows\system32\atl.dll
2009-07-15 12:40 . 2009-08-12 18:40 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-07-15 12:39 . 2009-08-12 18:40 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-15 12:39 . 2009-08-12 18:40 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-07-15 12:39 . 2009-08-12 18:40 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-07-11 19:01 . 2009-09-09 18:48 302592 ----a-w- c:\windows\system32\wlansec.dll
2009-07-11 19:01 . 2009-09-09 18:48 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2009-07-11 19:01 . 2009-09-09 18:48 513536 ----a-w- c:\windows\system32\wlansvc.dll
2009-07-11 19:01 . 2009-09-09 18:48 65024 ----a-w- c:\windows\system32\wlanapi.dll
2009-07-11 17:03 . 2009-09-09 18:48 127488 ----a-w- c:\windows\system32\L2SecHC.dll
2009-07-01 13:38 . 2009-07-01 01:27 52776 ----a-w- c:\users\admin\AppData\Local\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2006-11-22 813912]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 849280]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-09-14 1796368]
"Gamevance"="c:\program files\Gamevance\gamevance32.exe" [2009-09-22 210544]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\guard32.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):87,59,2e,17,6e,fa,c9,01
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1693036436-3825122214-428003496-1000]
"EnableNotificationsRef"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\FirewallRules]
"{88D7BA7B-E56F-468E-AB35-310B4704BAB3}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{98C3B769-45E2-4381-9969-79878E37993F}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{84D60434-5D8C-4E00-BAC5-6E8F88771497}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{6059ECF2-1C0F-4BE1-BEA0-81A3A53986C2}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\System32\drivers\cmdguard.sys [9/14/2009 2:33 PM 128888]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\System32\drivers\cmdhlp.sys [9/14/2009 2:33 PM 29520]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\dr ivers\mbamswissarmy.sys [9/14/2009 2:12 PM 38224]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSe tup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-09-27 c:\windows\Tasks\AWC Startup.job
- c:\program files\IObit\Advanced SystemCare 3\AWC.exe [2009-09-26 14:55]
2009-09-27 c:\windows\Tasks\User_Feed_Synchronization-{58DDF27C-B3A0-4505-AAEB-5DC6931F2009}.job
- c:\windows\system32\msfeedssync.exe [2009-07-30 20:13]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = *.local
TCP: {8B64435F-6597-417E-A2A9-DAC6C50AE0E7} = 156.154.70.22,156.154.71.22
.
************************************************** ************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
GMER - Rootkit Detector and Remover
Rootkit scan 2009-09-27 15:04
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
************************************************** ************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macrome d\\Flash\\FlashUtil10c.exe,-101"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUt il10c.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Other Running Processes ------------------------
.
c:\program files\COMODO\COMODO Internet Security\cmdagent.exe
c:\windows\System32\audiodg.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\servicing\TrustedInstaller.exe
.
************************************************** ************************
.
Completion time: 2009-09-27 15:10 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-27 20:10
Pre-Run: 202,393,690,112 bytes free
Post-Run: 202,236,055,552 bytes free
184 --- E O F --- 2009-09-26 00:39
hijack This log 
Linear Mode
