Karl`s PC Help Forums Last active: Never
Not logged in [Login ]
Go To Bottom

In memory of Karl Davis, founder of this board, who made his final journey 12th June 2007

Printable Version | Subscribe | Add to Favourites   Post new thread Poll:
Author: Subject: Is this computer infection-free?
EpheMeroN
Custom User Title
*******




Posts: 406
Registered: 16-3-2004
Theme: KF Blue (Default)
Member Is Offline

Mood: Revived

[*] Post 407308 posted on 11-4-2010 at 22:40 Reply With Quote
Is this computer infection-free?



I had an infected machine here over the weekend. I ran the usual scans with Spybot, MBAM, SuperAntiSpyware, Avira AntiVir, ComboFix, HJT, Sophos Anti-Rootkit, F-Secure Blacklight, cleaned out temp files w/ CCleaner and ran CHKDSK to fix Windows errors.

HJT Log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:48:36 AM, on 4/11/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.caldirectsecuredocs.com
O15 - Trusted Zone: http://www.ditechsecuredocs.com
O15 - Trusted Zone: http://www.ditechsecuredocs.net
O15 - Trusted Zone: http://www.docmagic.com
O15 - Trusted Zone: http://ctest.elynx.net
O15 - Trusted Zone: http://forms.elynx.net
O15 - Trusted Zone: http://gmacforms.elynx.net
O15 - Trusted Zone: http://pro.elynx.net
O15 - Trusted Zone: http://secure.elynx.net
O15 - Trusted Zone: http://usign.elynx.net
O15 - Trusted Zone: http://webpost.elynx.net
O15 - Trusted Zone: http://www.gmacmsecuredocs.com
O15 - Trusted Zone: http://www.gmacmsecuredocs.net
O15 - Trusted Zone: http://www.gmamcsecuredocs.com
O15 - Trusted Zone: http://loandocs.ss3.swiftsend.com
O15 - Trusted Zone: http://docs.swiftsend.com
O15 - Trusted Zone: http://loandocs.swiftsend.com
O15 - Trusted Zone: http://docs.swiftsend2.com
O15 - Trusted Zone: http://loandocs.swiftsend2.com
O15 - Trusted Zone: http://www.swiftview.com
O15 - Trusted Zone: http://www.wamuloandocs.com
O16 - DPF: {7DD62E58-5FA8-11D2-AFB7-00104B64F126} (Sview Control) - https://www.digitaldocs.cc/GetDocs/cab/svinstall_a_stat.cab
O16 - DPF: {7DD62E58-5FA8-11D2-AFB7-00104B64F127} (Sview Control) - https://secure.elynx.net/viewer/installers/svinstall_t_zhp_ss.exe
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {C86FF4B0-AA1D-46D4-8612-025FB86583C7} (AstoundLauncher Control) - http://zone.msn.com/bingame/jobo/default/AstoundLauncher.cab#version=1,0,0,10
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = vescrow.local
O17 - HKLM\Software\..\Telephony: DomainName = vescrow.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = vescrow.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = vescrow.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = vescrow.local
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe

--
End of file - 6367 bytes

ComboFix Log
ComboFix 10-04-10.02 - jnaranjo 04/11/2010 11:49:58.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.502.154 [GMT -7:00]
Running from: c:\documents and settings\jnaranjo.VESCROW\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((( Files Created from 2010-03-11 to 2010-04-11 )))))))))))))))))))))))))))))))
.

2010-04-11 16:53 . 2010-04-11 16:53 -------- d-----w- c:\program files\ESET
2010-04-11 16:47 . 2010-04-11 16:48 -------- d-----w- C:\backups
2010-04-11 16:06 . 2010-04-11 16:06 -------- d-----w- c:\documents and settings\jnaranjo.VESCROW\Application Data\Avira
2010-04-11 15:53 . 2008-05-09 10:53 90112 -c----w- c:\windows\system32\dllcache\wshext.dll
2010-04-11 15:53 . 2008-05-09 10:53 172032 -c----w- c:\windows\system32\dllcache\scrrun.dll
2010-04-11 15:53 . 2008-05-09 10:53 180224 -c----w- c:\windows\system32\dllcache\scrobj.dll
2010-04-11 15:53 . 2008-05-09 08:45 135168 -c----w- c:\windows\system32\dllcache\cscript.exe
2010-04-11 15:53 . 2008-05-08 11:24 155648 -c----w- c:\windows\system32\dllcache\wscript.exe
2010-04-11 05:18 . 2010-04-11 05:18 -------- d-----w- c:\program files\Sophos
2010-04-11 03:31 . 2010-04-11 03:31 -------- d-----w- c:\documents and settings\jnaranjo.VESCROW\Application Data\Malwarebytes
2010-04-11 03:13 . 2010-04-11 03:13 -------- d-----w- c:\documents and settings\jnaranjo.VESCROW\Application Data\Auslogics
2010-04-11 03:12 . 2010-02-20 04:07 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-04-11 03:12 . 2010-04-11 03:12 -------- d-----w- c:\program files\ffdshow
2010-04-11 02:56 . 2010-04-11 02:56 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-04-11 02:55 . 2010-04-11 02:55 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-04-11 02:39 . 2010-04-11 02:39 -------- d-----w- c:\windows\system32\scripting
2010-04-11 02:39 . 2010-04-11 02:39 -------- d-----w- c:\windows\system32\en
2010-04-11 02:39 . 2010-04-11 02:39 -------- d-----w- c:\windows\system32\bits
2010-04-11 01:49 . 2010-04-11 01:53 -------- d-----w- c:\windows\$regcmp$
2010-04-11 01:49 . 2010-04-11 01:49 -------- d-----w- c:\program files\Registry Clean Expert
2010-04-11 00:22 . 2010-04-11 00:22 52224 ----a-w- c:\documents and settings\Administrator.PC3\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-04-11 00:22 . 2010-04-11 00:22 117760 ----a-w- c:\documents and settings\Administrator.PC3\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-04-11 00:21 . 2010-04-11 00:21 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-04-11 00:13 . 2010-04-11 00:13 -------- d-----w- c:\documents and settings\Administrator.PC3\Application Data\Auslogics
2010-04-11 00:06 . 2010-04-11 00:07 -------- d-----w- c:\windows\system32\NtmsData
2010-04-10 23:43 . 2010-04-10 23:43 -------- d-----w- c:\documents and settings\Administrator.PC3\Application Data\Avira
2010-04-10 23:01 . 2004-08-04 07:56 21504 ----a-w- c:\windows\system32\drivers\hidserv.dll
2010-04-10 23:00 . 2010-04-10 23:00 -------- d-----w- c:\documents and settings\Administrator.PC3\Application Data\Malwarebytes
2010-04-10 23:00 . 2010-03-30 07:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-10 23:00 . 2010-04-10 23:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-10 23:00 . 2010-04-10 23:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-10 23:00 . 2010-03-30 07:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-10 22:59 . 2010-04-10 22:59 -------- d-----w- c:\program files\Auslogics
2010-04-10 22:59 . 2010-04-10 22:59 -------- d-----w- c:\program files\Foxit Software
2010-04-10 22:53 . 2010-04-10 22:54 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-04-10 22:52 . 2010-04-10 22:52 -------- d-----w- c:\program files\SpywareBlaster
2010-04-10 22:51 . 2010-04-10 22:51 -------- d-----w- c:\program files\Common Files\Java
2010-04-10 22:51 . 2010-04-10 22:51 61440 ----a-w- c:\documents and settings\Administrator.PC3\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-399d6e8b-n\decora-sse.dll
2010-04-10 22:51 . 2010-04-10 22:51 503808 ----a-w- c:\documents and settings\Administrator.PC3\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-51048657-n\msvcp71.dll
2010-04-10 22:51 . 2010-04-10 22:51 499712 ----a-w- c:\documents and settings\Administrator.PC3\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-51048657-n\jmc.dll
2010-04-10 22:51 . 2010-04-10 22:51 348160 ----a-w- c:\documents and settings\Administrator.PC3\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-51048657-n\msvcr71.dll
2010-04-10 22:51 . 2010-04-10 22:51 12800 ----a-w- c:\documents and settings\Administrator.PC3\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-399d6e8b-n\decora-d3d.dll
2010-04-10 22:51 . 2010-04-10 22:51 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-04-10 22:51 . 2010-04-10 22:51 -------- d-----w- c:\program files\Java
2010-04-10 22:47 . 2010-04-10 22:47 -------- d-----w- c:\program files\Avira
2010-04-10 22:47 . 2010-04-10 22:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-04-10 22:47 . 2010-03-01 16:05 124784 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-04-10 22:47 . 2010-02-16 20:24 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-04-10 22:47 . 2009-05-11 18:49 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-04-10 22:47 . 2009-05-11 18:49 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-04-10 22:38 . 2010-04-11 00:14 -------- d-----w- c:\documents and settings\Administrator.PC3\Local Settings\Application Data\Google
2010-04-10 22:38 . 2010-04-11 00:21 -------- d-----w- c:\documents and settings\Administrator.PC3\Application Data\SUPERAntiSpyware.com
2010-04-10 22:35 . 2010-04-10 22:35 -------- d-----w- c:\documents and settings\Administrator.PC3\Local Settings\Application Data\Adobe
2010-04-10 22:01 . 2010-04-10 22:02 -------- d-----w- c:\windows\system32\Adobe
2010-04-10 22:01 . 2010-04-10 22:01 1956656 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
2010-04-10 21:53 . 2010-04-10 21:53 -------- d-----w- c:\program files\VS Revo Group
2010-04-10 21:49 . 2010-04-10 21:49 401720 ----a-w- C:\HijackThis.exe
2010-04-10 21:46 . 2010-04-10 21:46 -------- d-sh--w- c:\documents and settings\Administrator.PC3\PrivacIE
2010-04-10 20:22 . 2010-04-10 20:22 -------- d-sh--w- c:\documents and settings\Administrator.PC3\IETldCache
2010-03-19 20:34 . 2010-03-19 20:34 -------- d-sh--w- c:\documents and settings\jnaranjo.VESCROW\PrivacIE
2010-03-19 19:18 . 2010-03-19 19:18 -------- d-sh--w- c:\documents and settings\jnaranjo.VESCROW\IETldCache
2010-03-19 19:17 . 2010-03-19 19:17 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-03-19 19:01 . 2010-04-01 00:01 -------- d-----w- c:\windows\ie8updates
2010-03-19 18:50 . 2010-03-19 18:59 -------- dc-h--w- c:\windows\ie8
2010-03-19 18:32 . 2009-12-11 08:38 69120 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-03-19 18:32 . 2010-02-25 06:24 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-03-19 18:32 . 2010-02-25 06:24 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-03-18 19:24 . 2010-04-09 07:31 -------- d-----w- c:\documents and settings\All Users\Application Data\FileCure
2010-03-12 21:40 . 2010-03-12 21:40 0 ----a-w- c:\windows\system32\srfvdo.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-11 14:54 . 2007-11-24 00:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-11 12:27 . 2008-01-23 18:50 -------- d-----w- c:\program files\LogMeIn
2010-04-11 03:02 . 2008-09-02 20:09 69040 ----a-w- c:\documents and settings\jnaranjo.VESCROW\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-11 02:41 . 2007-11-23 23:06 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-04-11 00:21 . 2007-11-24 00:25 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-04-10 23:02 . 2010-04-10 23:02 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2010-04-10 23:02 . 2010-04-10 23:02 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2010-04-10 22:34 . 2007-11-24 00:01 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-10 22:15 . 2008-01-10 23:48 -------- d-----w- c:\program files\MSN Games
2010-04-10 22:05 . 2009-07-09 18:11 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-04-10 22:04 . 2010-01-05 20:45 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2010-04-10 21:52 . 2007-11-23 23:57 -------- d-----w- c:\program files\CCleaner
2010-04-01 21:39 . 2010-02-04 20:49 -------- d-----w- c:\documents and settings\jnaranjo.VESCROW\Application Data\Lexmark Productivity Studio
2010-03-12 21:40 . 2008-02-15 23:59 -------- d-----w- c:\program files\SwiftView
2010-03-02 20:23 . 2010-02-11 17:05 -------- d-----w- c:\documents and settings\jnaranjo.VESCROW\Application Data\X5400 Series
2010-03-02 20:23 . 2010-02-04 20:34 -------- d-----w- c:\program files\Lexmark X5400 Series
2010-02-25 06:24 . 2007-10-07 13:54 916480 ------w- c:\windows\system32\wininet.dll
2010-02-19 22:12 . 2010-02-04 20:36 -------- d-----w- c:\program files\Abbyy FineReader 6.0 Sprint
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-09 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143360]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-10-01 16:07 87352 ----a-w- c:\windows\system32\LMIinit.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^McAfee Security Scan.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan.lnk
backup=c:\windows\pss\McAfee Security Scan.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
2006-03-24 04:13 77824 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
2006-03-24 04:17 118784 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
2006-03-24 04:17 94208 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X5400 Series Fax Server]
2007-11-02 08:38 307880 ----a-w- c:\program files\Lexmark X5400 Series\fm3032.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
2007-08-03 23:09 63048 ----a-w- c:\program files\LogMeIn\x86\LogMeInSystray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxdvamon]
2007-11-02 08:38 25256 ----a-w- c:\program files\Lexmark X5400 Series\lxdvamon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxdvmon.exe]
2007-11-02 08:38 455336 ----a-w- c:\program files\Lexmark X5400 Series\lxdvmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2004-10-14 22:42 1404928 ----a-w- c:\program files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 18:43 248040 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-07-09 18:11 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/17/2010 11:15 AM 66632]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [4/10/2010 3:47 PM 135336]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [8/3/2007 4:09 PM 12856]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\4.tmp --> c:\windows\system32\4.tmp [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/17/2010 11:15 AM 12872]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/5/2010 3:10 PM 135664]
S4 lxdv_device;lxdv_device;c:\windows\system32\lxdvcoms.exe -service --> c:\windows\system32\lxdvcoms.exe -service [?]
S4 lxdvCATSCustConnectService;lxdvCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdvserv.exe [2/4/2010 1:39 PM 98984]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2010-04-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 22:10]

2010-04-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 22:10]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
Trusted Zone: caldirectsecuredocs.com\www
Trusted Zone: com\pennwest-edocs
Trusted Zone: ditechsecuredocs.com\www
Trusted Zone: ditechsecuredocs.net\www
Trusted Zone: docmagic.com\www
Trusted Zone: elynx.net\ctest
Trusted Zone: elynx.net\forms
Trusted Zone: elynx.net\gmacforms
Trusted Zone: elynx.net\pro
Trusted Zone: elynx.net\secure
Trusted Zone: elynx.net\usign
Trusted Zone: elynx.net\webpost
Trusted Zone: gmacmsecuredocs.com\www
Trusted Zone: gmacmsecuredocs.net\www
Trusted Zone: gmamcsecuredocs.com\www
Trusted Zone: ss3.swiftsend.com\loandocs
Trusted Zone: swiftsend.com\docs
Trusted Zone: swiftsend.com\loandocs
Trusted Zone: swiftsend2.com\docs
Trusted Zone: swiftsend2.com\loandocs
Trusted Zone: swiftview.com\www
Trusted Zone: wamuloandocs.com\www
DPF: {7DD62E58-5FA8-11D2-AFB7-00104B64F127} - hxxps://secure.elynx.net/viewer/installers/svinstall_t_zhp_ss.exe
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-11 11:54
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\4.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(648)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll

- - - - - - - > 'explorer.exe'(3040)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
Completion time: 2010-04-11 11:56:39
ComboFix-quarantined-files.txt 2010-04-11 18:56

Pre-Run: 25,706,823,680 bytes free
Post-Run: 25,695,637,504 bytes free

- - End Of File - - 403B5B0E5966944E072F21AB3A13C3D7
View User's Profile View All Posts By User
Pancake
Custom User Title
*******


Avatar


Posts: 537
Registered: 17-4-2006
Location: Victoria Australia
Theme: KF Blue (Default)
Member Is Offline

Mood: No Mood

[*] Post 407360 posted on 12-4-2010 at 23:10 Reply With Quote


It all looks fine but just a warning that you should never run Combofix unsupervised.It is a powerfull program and if wrongly used can reduce you compter to the status of a useless piece of junk.This tool is not a toy and not for everyday use. ComboFix SHOULD NOT be used unless requested by a skilled helper
View User's Profile View All Posts By User
Post new thread Poll:

Guest Notice
You are a guest, as a guest you can only see a maximum of 3 posts per thread.

If you want to see the rest, please click here to register.