| Over the last couple of days...I have noticed some strange things happening with Internet Explorer and the Microsoft Update Utility. When I am browsing the internet, the menu bar is constantly popping up and down and I, as well, cannot use the search bar or the address bar sometimes...it just will not let me put the cursor in there. I have to close IE down and re-open to use it. There has been a balloon in the "clock box" that tells me that I have Microsoft updates available...and when I try to install them, they fail. That has been there for about a month now.
What prompted me to search for help today was when I hit crtl+alt+delete I got a message that said that the feature had been turned off by the administrator.
I did do everything that is in the before you post forum...and here are the results. I could not find the SuperAntiSpyware log...but it just removed 14 cookies, and nothing else. Hope this helps...and any help would be greatly appreciated.
Thanks!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:50:39 PM, on 3/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Creative\SBAudigy4\DVDAudio\CTDVDDET.EXE
C:\Program Files\Creative\SBAudigy4\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\CTHELPER.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\AGRSMMSG.exe
D:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\SBAudigy4\DVDAudio\CTDVDDET.EXE" O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy4\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [RCSystem] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll" O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "D:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\System32\shdocvw.dll O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://gsn.worldwinner.com/games/v47/shared/FunGamesLoader.cabO16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1197866011125O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1197871400781O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.keepandshare.com/imageuploader4.5/ImageUploader4.cabO16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cabO16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u5-windows-i586-jc.cabO20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe --
End of file - 9592 bytes
ComboFix 08-03-30.2 - Robert and Greg 2008-03-30 20:09:52.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.602 [GMT -5:00]
Running from: C:\Documents and Settings\Robert and Greg\Desktop\ComboFix.exe
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
TimedOut: progfile.dat
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\winupdates
C:\Program Files\winupdates\a.zip
C:\temp\tn3
C:\WINDOWS\fkdnrwsv.dll
C:\WINDOWS\system32\abc2
C:\WINDOWS\system32\ex1
C:\WINDOWS\system32\ipd1
C:\WINDOWS\system32\oc9
C:\WINDOWS\system32\shel9
I:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-02-28 to 2008-03-31 )))))))))))))))))))))))))))))))
.
2008-03-30 19:52 . 2008-03-30 19:52 4,958,588 --a------ C:\WINDOWS\{00000001-00000000-0000000A-00001102-00000008-10211102}.BAK
2008-03-30 18:59 . 2008-03-30 20:05 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-03-30 18:59 . 2008-03-30 18:59 <DIR> d-------- C:\Documents and Settings\Robert and Greg\Application Data\SUPERAntiSpyware.com
2008-03-30 18:59 . 2008-03-30 18:59 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2008-03-30 18:51 . 2008-03-30 18:51 <DIR> d-------- C:\Program Files\CCleaner
2008-03-30 16:40 . 2008-03-30 16:40 <DIR> d-------- C:\Program Files\Lavasoft
2008-03-30 16:40 . 2008-03-30 16:41 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-03-29 12:55 . 2008-03-29 12:55 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\FunGames
2008-03-25 14:03 . 2008-03-28 18:12 <DIR> d-------- C:\Documents and Settings\Robert and Greg\.uicentral4
2008-03-17 23:07 . 2008-03-18 02:37 <DIR> d-------- C:\Documents and Settings\Robert and Greg\Application Data\Spandex Force
2008-03-16 12:59 . 2008-03-16 13:14 59 --a------ C:\WINDOWS\ANS2000.INI
2008-03-16 12:59 . 2008-03-16 12:59 20 --ah----- C:\WINDOWS\akebook.ini
2008-03-16 12:59 . 2008-03-16 12:59 4 --ah----- C:\WINDOWS\a3kebook.ini
2008-03-15 19:24 . 2008-03-15 19:24 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\eBay
2008-03-11 13:29 . 2008-03-11 13:38 <DIR> d-------- C:\Documents and Settings\Robert and Greg\Application Data\NCH Swift Sound
2008-03-11 13:29 . 2008-03-11 13:29 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\NCH Swift Sound
2008-03-06 20:27 . 2008-03-06 20:27 <DIR> d-------- C:\Documents and Settings\Robert and Greg\Application Data\eGames
2008-03-06 20:27 . 2008-03-06 20:27 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\eGames
2008-03-06 18:57 . 2008-03-06 18:57 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\HipSoft
2008-02-24 13:27 . 2008-02-24 13:27 <DIR> d-------- C:\Documents and Settings\Robert and Greg\Application Data\Apple Computer
2008-02-24 13:22 . 2008-03-30 06:36 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-24 13:22 . 2008-02-24 13:27 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-24 13:21 . 2008-02-24 13:21 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-02-24 13:21 . 2008-02-24 13:21 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple
2008-02-23 18:57 . 2008-02-23 18:57 <DIR> d-------- C:\Documents and Settings\Robert and Greg\Application Data\mathijs.jurresip.nl
2008-02-23 18:29 . 2008-02-23 18:29 <DIR> d-------- C:\Program Files\Auslogics
2008-02-23 18:29 . 2008-02-23 18:29 <DIR> d-------- C:\Documents and Settings\Robert and Greg\Application Data\Auslogics
2008-02-23 18:10 . 2008-02-23 18:10 138,624 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2008-02-23 18:09 . 2008-03-30 18:54 <DIR> d-------- C:\Program Files\Spyware Terminator
2008-02-23 18:09 . 2008-03-26 01:46 <DIR> d-------- C:\Program Files\Crawler
2008-02-23 18:09 . 2008-03-30 17:19 <DIR> d-------- C:\Documents and Settings\Robert and Greg\Application Data\Spyware Terminator
2008-02-23 18:09 . 2008-03-30 18:54 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spyware Terminator
2008-02-23 18:07 . 2008-02-23 18:07 <DIR> d-------- C:\Program Files\YourWare Solutions
2008-02-23 18:05 . 2008-02-23 18:07 <DIR> d-------- C:\Program Files\Quick StartUp
2008-02-23 18:04 . 2008-03-30 16:33 <DIR> d-------- C:\Documents and Settings\Robert and Greg\Application Data\wsInspector
2008-02-23 18:03 . 2008-02-23 18:04 <DIR> d-------- C:\Program Files\Startup Inspector for Windows
2008-02-23 18:00 . 2008-02-23 18:03 <DIR> d-------- C:\Program Files\XP SafeGuard
2008-02-23 16:07 . 2008-02-23 16:43 <DIR> d-------- C:\Documents and Settings\Robert and Greg\Application Data\GlarySoft
2008-02-23 16:01 . 2008-02-23 16:01 <DIR> d-------- C:\Program Files\Glary Utilities
2008-02-22 16:27 . 2008-02-22 16:27 <DIR> d-------- C:\Program Files\IncGamers Client
2008-02-20 12:31 . 2008-02-20 12:31 1,044,480 -ra------ C:\WINDOWS\system32\roboex32.dll
2008-02-20 12:31 . 2008-02-20 12:31 49,152 -ra------ C:\WINDOWS\system32\inetwh32.dll
2008-02-17 12:36 . 2008-02-17 12:39 <DIR> d-------- C:\Documents and Settings\Robert and Greg\Application Data\OfficeUpdate12
2008-02-05 15:33 . 2008-02-05 15:33 <DIR> d-------- C:\WINDOWS\.jagex_cache_32
2008-02-02 17:29 . 2008-02-02 17:29 <DIR> d-------- C:\Documents and Settings\Robert and Greg\Application Data\CaribbeanHideaway
2008-02-02 13:26 . 2008-02-02 13:26 <DIR> d-------- C:\Program Files\ReflexiveArcade
2008-02-01 00:13 . 2008-02-01 00:13 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-02-01 00:13 . 2008-02-01 00:13 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-30 23:58 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-18 19:55 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\FLEXnet
2008-03-11 18:10 --------- d-----w C:\Program Files\Java
2008-02-24 18:22 --------- d-----w C:\Program Files\QuickTime
2008-02-24 18:21 --------- d-----w C:\Program Files\Apple Software Update
2008-02-17 17:23 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo! Companion
2008-02-17 12:38 --------- d-----w C:\Program Files\a-squared Free
2008-02-02 18:27 --------- d-----w C:\Documents and Settings\Robert and Greg\Application Data\PlayFirst
2008-02-02 18:27 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\PlayFirst
2008-02-01 23:58 --------- d-----w C:\Program Files\BFG
2008-01-31 10:42 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Aol
2008-01-30 21:14 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Zylom
2008-01-30 20:20 51,716 ----a-w C:\WINDOWS\system32\pdf995mon.dll
2008-01-30 20:20 249,856 ----a-w C:\WINDOWS\system32\pdfmona.dll
2008-01-30 20:20 --------- d-----w C:\Documents and Settings\Robert and Greg\Application Data\TaxCut
2008-01-30 20:20 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\pdf995
2008-01-30 20:19 --------- d-----w C:\Program Files\TaxCut07
2008-01-30 20:16 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\TaxCut
2008-01-28 19:39 --------- d-----w C:\Documents and Settings\Robert and Greg\Application Data\Oberon Games
2008-01-28 19:39 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Oberon Games
2008-01-13 00:54 230,454 ----a-w C:\StiImg.dat
2007-12-17 03:57 81,920 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2007-12-17 03:57 233,472 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2007-12-14 16:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2005-08-17 11:50 85,832 ----a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 21:23 102400]
"ATI Remote Control"="C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe" [2004-04-16 07:43 196608]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTDVDDET"="C:\Program Files\Creative\SBAudigy4\DVDAudio\CTDVDDET.EXE" [2003-06-18 04:00 45056]
"CTSysVol"="C:\Program Files\Creative\SBAudigy4\Surround Mixer\CTSysVol.exe" [2005-02-15 19:10 57344]
"RCSystem"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 21:25 49152]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 21:25 49152]
"CTHelper"="CTHELPER.EXE" [2005-06-18 01:01 16384 C:\WINDOWS\CTHELPER.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 04:00 90112]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-07-11 00:10 339968]
"ATI DeviceDetect"="C:\Program Files\ATI Multimedia\main\ATIDtct.EXE" [2004-06-15 23:17 69705]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 08:00 79224]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-08-20 16:55 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-08-20 16:51 118784]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 10:06 88363 C:\WINDOWS\AGRSMMSG.exe]
"Acrobat Assistant 8.0"="D:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 20:54 623992]
"Adobe_ID0EYTHM"="C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 17:40 1884160]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-02-23 18:10 2731008]
C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-11-26 15:43:13 113664]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{0095E4DA-D7A2-456A-AE04-EB9ABF822FE4}"= C:\DOCUME~1\ROBERT~1\LOCALS~1\Temp\wowow.dll [2008-03-26 09:43 17120]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
--a------ 2005-07-12 06:17 50776 C:\Program Files\America Online 9.0\AOL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreeRAM XP]
-ra------ 2006-03-23 01:13 1591808 C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-02-01 00:13 385024 C:\Program Files\QuickTime\qttask.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\mmc.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\SightSpeed\\SightSpeed.exe"=
"C:\\Program Files\\Java\\jre1.6.0_05\\bin\\javaw.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server
R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2008-02-23 18:10]
*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-03-24 22:48:14 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2008-03-30 20:22:30 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\Ati2evxx.dll
.
Completion time: 2008-03-30 20:26:06
ComboFix-quarantined-files.txt 2008-03-31 01:26:03
Pre-Run: 1,942,593,536 bytes free
Post-Run: 1,929,744,384 bytes free
.
2008-03-30 10:04:58 --- E O F ---
| 
|