ComboLog:
"Maria" - 2007-07-26 18:08:16 - ComboFix 07-07-23.6 - Service Pack 2
FAT32 ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\3_exception.nls
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
-------\LEGACY_ASC3550U
-------\LEGACY_NTMLSVC
-------\LEGACY_RUNTIME
-------\LEGACY_RUNTIME2
-------\asc3550u
-------\NtmlSvc
-------\runtime
((((((((((((((((((((((((( Files Created from 2007-06-26 to 2007-07-26 )))))))))))))))))))))))))))))))
2007-07-26 18:07 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-26 16:19 <DIR> d-------- C:\Programmer\CCleaner
2007-07-26 04:09 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\SUPERAntiSpyware.com
2007-07-25 22:55 75,932 --a------ C:\WINDOWS\system32\drivers\klick.dat
2007-07-25 22:55 74,396 --a------ C:\WINDOWS\system32\drivers\klin.dat
2007-07-25 22:54 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2007-07-25 22:54 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-07-25 22:54 <DIR> d-------- C:\Programmer\Kaspersky Lab
2007-07-25 22:54 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-07-25 22:26 <DIR> d-------- C:\KAV
2007-07-25 03:41 <DIR> d-------- C:\DOCUME~1\Maria\APPLIC~1\Prevx
2007-07-25 03:40 13,824 --a------ C:\WINDOWS\system32\pxscinst.dll
2007-07-25 03:40 <DIR> d-------- C:\Programmer\Prevx2
2007-07-25 03:40 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Prevx
2007-07-25 03:39 77,312 --a------ C:\WINDOWS\ua2.dll
2007-07-25 03:31 <DIR> d-------- C:\Programmer\NoAdware5.0
2007-07-25 01:32 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-07-25 01:31 <DIR> d-------- C:\Programmer\SUPERAntiSpyware
2007-07-25 01:31 <DIR> d-------- C:\DOCUME~1\Maria\APPLIC~1\SUPERAntiSpyware.com
2007-07-24 23:51 8,704 --a------ C:\WINDOWS\system32\drivers\TVicPort64.sys
2007-07-24 23:51 8,704 --a------ C:\WINDOWS\system32\drivers\int15_64.sys
2007-07-24 23:51 69,632 --a------ C:\WINDOWS\system32\drivers\int15.sys
2007-07-24 23:51 6,144 --a------ C:\WINDOWS\system32\drivers\zntport64.sys
2007-07-24 23:51 6,080 --a------ C:\WINDOWS\system32\drivers\zntport.sys
2007-07-24 23:51 14,544 --a------ C:\WINDOWS\system32\drivers\TVicPort.sys
2007-07-24 23:34 602,112 --a------ C:\WINDOWS\system32\Acer.Empowering.Windows.Forms_v820.dll
2007-07-24 23:34 602,112 --a------ C:\WINDOWS\system32\Acer.Empowering.Windows.Forms.dll
2007-07-24 23:34 53,248 --a------ C:\WINDOWS\system32\Interop.Shell32.dll
2007-07-24 23:34 331,776 --a------ C:\WINDOWS\system32\ScrollBarLib.dll
2007-07-24 23:30 <DIR> d-------- C:\DOCUME~1\Maria\APPLIC~1\CyberLink
2007-07-24 22:30 <DIR> d-------- C:\Programmer\Lavasoft
2007-07-24 22:30 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-24 21:55 <DIR> d-------- C:\Programmer\F‘lles filer\Wise Installation Wizard
2007-07-24 21:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-07-24 21:31 786,432 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-07-24 21:31 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menuen Start
2007-07-24 21:31 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Foretrukne
2007-07-24 21:31 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Dokumenter
2007-07-24 21:31 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Skabeloner
2007-07-24 21:31 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Printere
2007-07-24 21:31 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Lokale indstillinger
2007-07-24 21:31 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Andre computere
2007-07-24 21:31 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Skrivebord
2007-07-24 21:31 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\ATI
2007-07-24 20:12 <DIR> d-------- C:\Programmer\Norton AntiVirus
2007-07-24 20:11 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-07-24 20:10 <DIR> d-------- C:\Programmer\F‘lles filer\Symantec Shared
2007-07-24 12:31 7,277 --a------ C:\DOCUME~1\Maria\usyoyk.exe
2007-07-24 11:36 7,277 --a------ C:\DOCUME~1\Maria\zezxnn.exe
2007-07-24 11:05 <DIR> d--hs---- C:\FOUND.001
2007-07-24 03:55 8,192 --a------ C:\WINDOWS\system32\drivers\Changer.sys
2007-07-24 00:51 <DIR> d--hs---- C:\FOUND.000
2007-07-22 03:02 <DIR> d-------- C:\Programmer\MSXML 4.0
2007-07-21 03:00 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2007-07-20 16:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-07-20 16:19 208,248 --a------ C:\WINDOWS\system32\muweb.dll
2007-07-20 12:53 <DIR> d-------- C:\DOCUME~1\Maria\APPLIC~1\Help
2007-07-20 00:19 <DIR> d-------- C:\DOCUME~1\Maria\APPLIC~1\Google
2007-07-20 00:18 <DIR> d-------- C:\Programmer\Google
2007-07-20 00:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-07-19 23:45 258,048 --a------ C:\WINDOWS\system32\Uninstall_eRecovery.exe
2007-07-19 23:45 258,048 --a------ C:\WINDOWS\system32\CheckD2DSystem.exe
2007-07-19 23:45 16,384 --a------ C:\WINDOWS\system32\ClearEvent.exe
2007-07-19 23:45 159,744 --a------ C:\WINDOWS\system32\CloseProcessWindow.dll
2007-07-19 23:45 1,168,896 --a------ C:\WINDOWS\system32\ERUpdateHidden.EXE
2007-07-19 23:44 <DIR> d-------- C:\WINDOWS\Options
2007-07-19 23:42 <DIR> d-------- C:\Programmer\Launch Manager
2007-07-19 23:41 94,298 --a------ C:\WINDOWS\system32\SynTPAPI.dll
2007-07-19 23:41 82,013 --a------ C:\WINDOWS\system32\SynCOM.dll
2007-07-19 23:41 81,920 --a------ C:\WINDOWS\system32\SynTPCo2.dll
2007-07-19 23:41 69,722 --a------ C:\WINDOWS\system32\SynTPFcs.dll
2007-07-19 23:41 192,672 --a------ C:\WINDOWS\system32\drivers\SynTP.sys
2007-07-19 23:41 114,688 --a------ C:\WINDOWS\system32\SynCtrl.dll
2007-07-19 23:41 <DIR> d-------- C:\Programmer\Synaptics
2007-07-19 23:40 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-07-19 23:36 69,632 -ra------ C:\WINDOWS\Alcmtr.exe
2007-07-19 23:36 2,879,488 -ra------ C:\WINDOWS\SkyTel.exe
2007-07-19 23:36 135,168 --a------ C:\WINDOWS\system32\RtlCPAPI.dll
2007-07-19 23:24 2,621,440 --ah----- C:\DOCUME~1\Maria\NTUSER.DAT
2007-07-19 23:24 <DIR> dr------- C:\DOCUME~1\Maria\Foretrukne
2007-07-19 23:24 <DIR> dr------- C:\DOCUME~1\Maria\Dokumenter
2007-07-19 23:24 <DIR> d--h----- C:\DOCUME~1\Maria\Skabeloner
2007-07-19 23:24 <DIR> d--h----- C:\DOCUME~1\Maria\Printere
2007-07-19 23:24 <DIR> d--h----- C:\DOCUME~1\Maria\Lokale indstillinger
2007-07-19 23:24 <DIR> d--h----- C:\DOCUME~1\Maria\Andre computere
2007-07-19 23:24 <DIR> d-------- C:\WINDOWS\Acer
2007-07-19 23:24 <DIR> d-------- C:\DOCUME~1\Maria\Skrivebord
2007-07-19 23:24 <DIR> d-------- C:\DOCUME~1\Maria\Menuen Start
2007-07-19 23:24 <DIR> d-------- C:\DOCUME~1\Maria\APPLIC~1\ATI
2007-07-19 23:23 262,144 --a------ C:\DOCUME~1\ALLUSE~1\NTUSER.DAT
2007-07-19 23:23 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\APPLIC~1\ATI
2007-07-19 23:20 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
2007-07-19 23:20 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
2007-07-19 23:20 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2007-07-19 23:20 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys
2007-07-19 23:20 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
2007-07-19 23:20 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
2007-07-19 23:20 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
2007-07-19 23:19 54,272 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2007-07-19 23:19 <DIR> d-------- C:\WINDOWS\BisonCam
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-07-26 16:21:30 32 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2007-07-26 16:21:30 32 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-07-24 19:56:00 -------- d-----w C:\Programmer\Fælles filer\Wise Installation Wizard
2007-07-24 18:10:58 -------- d-----w C:\Programmer\Fælles filer\Symantec Shared
2007-07-19 21:18:44 903 ----a-r C:\WINDOWS\HotFix.bat
2007-07-19 21:18:42 948 ----a-r C:\WINDOWS\CLEANUP.CMD
2007-07-19 16:27:10 74,492 ----a-r C:\WINDOWS\system32\perfc006.dat
2007-07-19 16:27:10 416,886 ----a-r C:\WINDOWS\system32\perfh006.dat
2007-06-04 13:18:48 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 13:17:02 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 13:14:56 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-05-16 15:14:26 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" []
"AzMixerSel"="C:\Programmer\Realtek\InstallShield\AzMixerSel.exe" [2006-04-14 22:35]
"PCMService"="C:\Program Files\Acer\Acer Arcade\PCMService.exe" [2006-04-27 12:10]
"ATICCC"="C:\Programmer\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-27 23:54 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 03:04 C:\WINDOWS\SkyTel.exe]
"Alcmtr"="ALCMTR.EXE" [2005-05-03 03:43 C:\WINDOWS\Alcmtr.exe]
"SynTPEnh"="C:\Programmer\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 13:07]
"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2006-06-23 06:59]
"Adobe Reader Speed Launcher"="C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"PrevxOne"="C:\Programmer\Prevx2\PXConsole.exe" [2007-07-10 07:42]
"eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 14:40]
"AVP"="C:\Programmer\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2007-03-09 19:50]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-27 05:00]
"SUPERAntiSpyware"="C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]
C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\
Acer Empowering Technology.lnk - C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2007-07-24 23:34:47]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"=0 (0x0)
"NoFind"=0 (0x0)
"NoRun"=0 (0x0)
"NoDesktop"=0 (0x0)
"NoControlPanel"=0 (0x0)
"NoClose"=0 (0x0)
"StartMenuLogOff"=0 (0x0)
"HideClock"=0 (0x0)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Programmer\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Programmer\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]
R0 agpCPQ;Compaq AGP-busfilter;C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
R0 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys
R0 viaagp;VIA AGP-busfilter;C:\WINDOWS\system32\DRIVERS\viaagp.sys
R1 AmdK8;Driver til AMD-processor;C:\WINDOWS\system32\DRIVERS\AmdK8.sys
R1 SASDIFSV;SASDIFSV;\??\C:\Programmer\SUPERAntiSpyware\SASDIFSV.SYS
R1 SASKUTIL;SASKUTIL;\??\C:\Programmer\SUPERAntiSpyware\SASKUTIL.sys
R1 WmiAcpi;Microsoft Windows Management-gr‘nseflade til ACPI;C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
R2 DritekPortIO;Dritek General Port I/O;\??\C:\PROGRA~1\LAUNCH~1\DPortIO.sys
R2 int15;int15;\??\C:\WINDOWS\system32\drivers\int15.sys
R2 tvicport;tvicport;\??\C:\WINDOWS\system32\drivers\tvicport.sys
R2 zntport;zntport;\??\C:\WINDOWS\system32\drivers\zntport.sys
R3 Cam5603D;Acer OrbiCam;C:\WINDOWS\system32\Drivers\BisonCam.sys
R3 DKbFltr;Dritek Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\DKbFltr.sys
R3 EMSCR;EMSCR;C:\WINDOWS\system32\DRIVERS\EMS7SK.sys
R3 ESDCR;ESDCR;C:\WINDOWS\system32\DRIVERS\ESD7SK.sys
R3 ESMCR;ESMCR;C:\WINDOWS\system32\DRIVERS\ESM7SK.sys
R3 HSF_DPV;HSF_DPV;C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
R3 HSFHWAZL;HSFHWAZL;C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
R3 NTIDrvr;Upper Class Filter Driver;C:\WINDOWS\system32\DRIVERS\NTIDrvr.sys
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver;C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys
R3 SASENUM;SASENUM;\??\C:\Programmer\SUPERAntiSpyware\SASENUM.SYS
R3 sdbus;sdbus;C:\WINDOWS\system32\DRIVERS\sdbus.sys
R3 SynTP;Synaptics TouchPad Driver;C:\WINDOWS\system32\DRIVERS\SynTP.sys
R3 usbehci;Miniportdriver til Microsoft USB 2.0-udvidet v‘rtscontroller;C:\WINDOWS\system32\DRIVERS\usbehci.sys
R3 usbhub;USB2-aktiveret hub;C:\WINDOWS\system32\DRIVERS\usbhub.sys
R3 usbohci;Miniportdriver til Microsoft USB-†ben v‘rtscontroller;C:\WINDOWS\system32\DRIVERS\usbohci.sys
S2 crvdll;Windows Messanager;C:\WINDOWS\System32\svchost.exe -k netsvcs
S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;\??\C:\WINDOWS\system32\eLock2BurnerLockDriver.sys
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;\??\C:\WINDOWS\system32\eLock2FSCTLDriver.sys
S2 Fax;Fax;C:\WINDOWS\system32\fxssvc.exe
S3 HSXHWAZL;HSXHWAZL;C:\WINDOWS\system32\DRIVERS\HSXHWAZL.sys
S3 irsir;Microsoft seriel infrar›d driver;C:\WINDOWS\system32\DRIVERS\irsir.sys
S3 TSP;TSP;\??\C:\WINDOWS\system32\drivers\klif.sys
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - netsvcs
crvdll
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2007-07-26 18:22:21
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\aawservice]
"ImagePath"="\"C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe\""
[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\viaagp]
"ImagePath"="system32\DRIVERS\viaagp.sys"
Completion time: 2007-07-26 18:27:10 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-26 18:27
--- E O F ---