ComboFix 08-12-06.06 - Administrator 2008-12-07 4:53:46.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.280 [GMT -8:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
C:\t0k3c.cmd
c:\windows\system32\amvo.exe
c:\windows\system32\amvo0.dll
D:\Autorun.inf
D:\t0k3c.cmd
F:\autorun.inf
F:\t0k3c.cmd
.
((((((((((((((((((((((((( Files Created from 2008-11-07 to 2008-12-07 )))))))))))))))))))))))))))))))
.
2008-12-05 13:53 . 2004-08-03 08:56 221,184 --a------ c:\windows\system32\wmpns.dll
2008-12-05 11:56 . 2008-12-05 11:57 <DIR> d-------- c:\program files\Java
2008-12-05 11:56 . 2008-12-05 11:56 <DIR> d-------- c:\program files\Common Files\Java
2008-12-05 11:56 . 2008-12-05 11:56 <DIR> d-------- C:\CollaborationPlayer
2008-12-05 11:55 . 2008-12-05 11:55 <DIR> d-------- c:\program files\Common Files\Adobe
2008-12-05 11:54 . 2004-08-03 23:08 26,496 --a--c--- c:\windows\system32\dllcache\usbstor.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-05 19:57 155,995 ----a-w c:\windows\java\Packages\RJ73LJ1J.ZIP
2008-12-05 18:58 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-05 18:55 --------- d-----w c:\documents and settings\All Users\Application Data\Bluetooth
2008-12-05 18:52 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-05 18:51 --------- d-----w c:\program files\Elantech
2008-12-05 18:48 --------- d-----w c:\program files\IVT Corporation
2008-12-05 18:46 --------- d-----w c:\program files\Intel
2008-12-05 18:42 --------- d-----w c:\program files\Realtek
2008-12-05 18:32 --------- d-----w c:\program files\microsoft frontpage
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-02-06 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-02-06 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-02-06 118784]
"KTPWare"="c:\program files\Elantech\ktp.exe" [2005-10-26 512000]
"BisonTrayIcon"="c:\windows\BisonCam\BisonTrayIcon.exe" [2005-09-05 45056]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_05\bin\jusched.exe" [2005-08-26 36975]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-03 c:\windows\system32\bthprops.cpl]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 c:\windows\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-01-11 c:\windows\RTHDCPL.exe]
"SMSERIAL"="sm56hlpr.exe" [2005-11-09 c:\windows\sm56hlpr.exe]
"CHotkey"="mHotkey.exe" [2001-12-26 c:\windows\mHotkey.exe]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2005-11-03 656384]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
R3 Ktp;Elantech Touchpad;c:\windows\system32\DRIVERS\Ktp.sys [2008-12-05 27520]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{462cfb01-c317-11dd-9cfa-001060301145}]
\SHeLl\AutOPlaY\coMmanD - F:\esfh.exe
\SHeLl\AutoRun\command - F:\esfh.exe
\SHeLl\ExpLoRe\comManD - F:\esfh.exe
\SHeLl\open\ComMANd - F:\esfh.exe
.
.
------- Supplementary Scan -------
.
O16 -: Microsoft XML Parser for Java -
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-12-07 04:56:00
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-12-07 4:56:40 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-07 12:56:38
Pre-Run: 22,847,168,512 bytes free
Post-Run: 22,838,009,856 bytes free
97
