Alright, here goes. Looks like it caught some more baddies.
ComboFix 08-10-16.08 - *********** 2008-10-17 19:17:31.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1384 [GMT -4:00]
Running from: C:\Documents and Settings\*********\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\WINDOWS\system32\dao350.dll
C:\WINDOWS\system32\dqqhxohi.ini
C:\WINDOWS\system32\ivudasbo.ini
C:\WINDOWS\system32\kosjplmv.ini
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\nisgstot.exe
C:\WINDOWS\system32\nnreirjs.exe
C:\WINDOWS\system32\uekrkqin.exe
.
((((((((((((((((((((((((( Files Created from 2008-09-17 to 2008-10-17 )))))))))))))))))))))))))))))))
.
2008-10-17 16:47 . 2008-10-17 16:47 <DIR> d-------- C:\Program Files\Trend Micro
2008-10-17 14:46 . 2008-10-17 14:46 <DIR> d-------- C:\Documents and Settings\**********\Application Data\SUPERAntiSpyware.com
2008-10-17 14:23 . 2008-10-17 14:23 <DIR> d--h----- C:\WINDOWS\PIF
2008-10-17 09:57 . 2008-10-17 09:57 <DIR> d-------- C:\Documents and Settings\**********\Application Data\Malwarebytes
2008-10-16 19:21 . 2008-10-16 19:21 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-10-16 19:05 . 2008-10-16 19:05 <DIR> d-------- C:\Documents and Settings\**********\Application Data\KESI
2008-10-16 17:25 . 2008-10-16 17:25 153,404 --a------ C:\WINDOWS\system32\g95.exe
2008-10-16 17:20 . 2008-10-16 17:20 <DIR> d-------- C:\Documents and Settings\**********\Application Data\Inspiration Software
2008-10-16 17:20 . 2008-10-17 13:49 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-10-16 17:20 . 2008-10-16 17:20 1,409 --a------ C:\WINDOWS\QTFont.for
2008-10-16 17:19 . 2008-04-14 05:41 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-10-16 17:19 . 2008-04-14 05:41 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-10-16 16:41 . 2008-10-16 16:41 90,915 --a------ C:\WINDOWS\system32\aiehpjlpnk.dll-uninst.exe
2008-10-16 16:31 . 2008-10-17 15:11 <DIR> d-------- C:\WINDOWS\system32\WS
2008-10-16 16:31 . 2008-10-16 16:31 <DIR> d-------- C:\WINDOWS\system32\pi
2008-10-16 16:31 . 2008-10-17 10:50 <DIR> d-------- C:\WINDOWS\system32\nys3
2008-10-16 16:31 . 2008-10-16 16:31 <DIR> d-------- C:\WINDOWS\system32\mco2
2008-10-16 16:31 . 2008-10-16 16:31 <DIR> d-------- C:\WINDOWS\system32\EV02
2008-10-16 16:31 . 2008-10-16 16:31 <DIR> d-------- C:\Temp\xp34
2008-10-16 16:31 . 2008-10-17 19:17 <DIR> d-------- C:\Temp
2008-10-16 16:31 . 2008-10-16 16:31 355 --a------ C:\145.bat
2008-10-16 16:30 . 2008-10-16 17:58 68 --a------ C:\Documents and Settings\**********\z.bat
2008-10-16 16:01 . 2008-10-16 17:58 45,568 --a------ C:\Documents and Settings\**********\index.exe
2008-10-15 15:18 . 2008-04-14 05:42 151,552 --a------ C:\WINDOWS\system32\irftp.exe
2008-10-15 15:18 . 2008-04-14 05:42 151,552 --a--c--- C:\WINDOWS\system32\dllcache\irftp.exe
2008-10-15 15:18 . 2008-04-14 05:41 28,160 --a------ C:\WINDOWS\system32\irmon.dll
2008-10-15 15:18 . 2008-04-14 05:41 28,160 --a--c--- C:\WINDOWS\system32\dllcache\irmon.dll
2008-10-15 15:18 . 2008-04-14 05:42 8,192 --a------ C:\WINDOWS\system32\wshirda.dll
2008-10-15 15:18 . 2008-04-14 05:42 8,192 --a--c--- C:\WINDOWS\system32\dllcache\wshirda.dll
2008-10-15 15:12 . 2008-10-15 15:12 <DIR> d-------- C:\Documents and Settings\**********\Application Data\Lenovo
2008-10-15 15:12 . 2008-10-17 10:50 <DIR> d-------- C:\Documents and Settings\**********
2008-10-14 14:42 . 2008-10-14 14:42 <DIR> d-------- C:\Program Files\Sonix
2008-10-06 14:44 . 2008-10-06 14:47 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-10-06 14:41 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\
003157_.tmp
2008-10-06 12:28 . 2008-10-06 12:28 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-06 12:28 . 2008-10-06 12:28 <DIR> d-------- C:\Documents and Settings\student\Application Data\Malwarebytes
2008-10-06 12:28 . 2008-10-06 12:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-06 12:28 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-06 12:28 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-06 12:18 . 2008-07-03 16:29 110,592 --a------ C:\WINDOWS\system32\SynTPCo4.dll
2008-10-06 09:48 . 2008-10-06 09:48 <DIR> d-------- C:\Program Files\RSA SecurID Token Common
2008-10-06 09:48 . 2008-10-06 09:48 <DIR> d-------- C:\Program Files\Common Files\ThinkVantage Fingerprint Software
2008-10-06 09:48 . 2008-10-06 09:48 <DIR> d-------- C:\Program Files\Common Files\SPBA
2008-10-06 09:47 . 2008-02-27 12:02 144,128 -----c--- C:\WINDOWS\system32\dllcache\usbport.sys
2008-10-06 09:46 . 2008-10-06 09:47 593,960 --a------ C:\WINDOWS\qfe7A.tmp
2008-10-06 09:27 . 2008-04-11 15:04 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-10-17 22:31 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-10-17 18:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-17 18:30 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-10-14 20:00 30,144 ----a-w C:\WINDOWS\system32\drivers\psadd.sys
2008-10-14 18:43 --------- d-----w C:\Program Files\InterVideo
2008-10-06 19:04 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-10-06 13:48 --------- d-----w C:\Program Files\ThinkVantage Fingerprint Software
2008-10-06 13:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\UIB
2008-09-25 05:47 4,442 ------w C:\WINDOWS\system32\drivers\TPPWRIF.SYS
2008-09-25 05:47 16,384 ------w C:\WINDOWS\PWMBTHLP.EXE
2008-07-22 16:20 1,406,344 ----a-w C:\WINDOWS\qfe86.tmp
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"snp2uvc"="C:\WINDOWS\vsnp2uvc.exe" [2006-12-28 569344]
"EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp .Exe" [2008-06-05 242976]
"TPHOTKEY"="C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe" [2008-03-24 68464]
"TPFNF7"="C:\PROGRA~1\Lenovo\NPDIRECT\TPFNF7SP.exe " [2008-07-31 60192]
"PWRMGRTR"="C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR .DLL" [2008-09-25 331776]
"BLOG"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL " [2008-09-25 208896]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2008-07-03 118784]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2008-07-03 1323008]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe" [2006-12-22 67752]
"LPManager"="C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe " [2008-01-11 144728]
"TVT Scheduler Proxy"="C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-03-04 487424]
"NDPS"="C:\WINDOWS\system32\dpmw32.exe" [2004-05-17 32859]
"TPKMAPHELPER"="C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" [2007-01-09 868352]
"AwaySch"="C:\Program Files\Lenovo\AwayTask\AwaySch.EXE" [2006-11-07 91688]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-12-11 1044480]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-03-21 13524992]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray. dll" [2008-03-21 86016]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2006-02-02 122940]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\I SUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 620152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-07-24 185896]
"Realtime Monitor"="C:\Program Files\CA\eTrustITM\realmon.exe" [2005-12-10 274432]
"LPMailChecker"="C:\PROGRA~1\THINKV~2\PrdCtr\LPMLC HK.exe" [2008-01-11 124248]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"TpShocks"="TpShocks.exe" [2008-06-06 C:\WINDOWS\system32\TpShocks.exe]
"NWTRAY"="NWTRAY.EXE" [2002-03-12 C:\WINDOWS\system32\nwtray.exe]
"nwiz"="nwiz.exe" [2008-03-21 C:\WINDOWS\system32\nwiz.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 C:\WINDOWS\system32\bthprops.cpl]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-25 443968]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000003}\_SC_Acrobat.exe [2008-07-22 295606]
Adobe Acrobat Synchronizer.lnk - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 734872]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-03-07 50688]
Notify.lnk - C:\Novell\GroupWise\notify.exe [2007-04-10 198224]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"CompatibleRUPSecurity"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 14:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2008-06-24 17:31 95496 C:\WINDOWS\system32\psqlpwd.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2006-09-06 16:37 34344 C:\Program Files\Lenovo\HOTKEY\notifyf2.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2008-03-17 16:02 34080 C:\Program Files\Lenovo\HOTKEY\tphklock.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\contro l\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwv1_0
Notification Packages REG_MULTI_SZ scecli psqlpwd
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cssauth]
--a------ 2007-08-03 16:35 2630968 C:\Program Files\Lenovo\Client Security Solution\cssauth.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-14 05:42 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray]
--a------ 2006-05-18 16:24 196696 C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-08-12 12:46 282624 C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\dpmw32.exe"=
"C:\\Novell\\GroupWise\\grpwise.exe"=
"C:\\Novell\\GroupWise\\notify.exe"=
"C:\\Program Files\\CA\\eTrustITM\\InoRpc.exe"=
"C:\\Program Files\\CA\\eTrustITM\\Realmon.exe"=
"C:\\Program Files\\CA\\eTrustITM\\Shellscn.exe"=
"C:\\Program Files\\CA\\SharedComponents\\iTechnology\\igateway .exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R0 Shockprf;Shockprf;C:\WINDOWS\system32\DRIVERS\Apsx 86.sys [2008-05-14 114728]
R0 TPDIGIMN;TPDIGIMN;C:\WINDOWS\system32\DRIVERS\ApsH M86.sys [2008-05-14 19496]
R1 TPPWRIF;TPPWRIF;C:\WINDOWS\system32\drivers\Tppwri f.sys [2008-09-25 4442]
R2 Power Manager DBC Service;Power Manager DBC Service;C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE [2008-09-25 94208]
R2 smihlp;SMI Helper Driver (smihlp);C:\Program Files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys [2008-06-24 12560]
R2 TVT Backup Protection Service;TVT Backup Protection Service;C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe [2007-07-11 569344]
R3 TVTI2C;Lenovo SM bus driver;C:\WINDOWS\system32\DRIVERS\Tvti2c.sys [2007-05-22 30336]
R3 WSIMD;wsimd Service;C:\WINDOWS\system32\DRIVERS\wsimd.sys [2007-07-03 57344]
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{2c5bd388-9aed-11dd-b6b8-0022697f3b07}]
\Shell\Auto\command - E:\Start.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{9d0e15c6-9c4d-11dd-b6c4-002268eddfb1}]
\Shell\Auto\command - E:\Start.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{d8a2f0c2-9bd8-11dd-b6c2-002268eddfb1}]
\Shell\Auto\command - E:\Start.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe
.
Contents of the 'Scheduled Tasks' folder
2008-10-17 C:\WINDOWS\Tasks\PMTask.job
- C:\PROGRA~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2008-09-25 01:47]
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-UpdateManager - C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
MSConfigStartUp-ACTray - C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
MSConfigStartUp-ACWLIcon - C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\**********\Application Data\Mozilla\Firefox\Profiles\zg4weycd.default\
.
************************************************** ************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-10-17 19:23:42
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
************************************************** ************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\WMNTAPI.DLL
PROCESS: C:\WINDOWS\Explorer.exe
-> C:\WINDOWS\system32\nview.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ibmpmsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\IPSSVC.EXE
C:\WINDOWS\system32\acs.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe
C:\Program Files\CA\eTrustITM\InoRpc.exe
C:\Program Files\CA\eTrustITM\InoRT.exe
C:\Program Files\CA\eTrustITM\InoTask.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\WINDOWS\system32\TPHDEXLG.exe
C:\WINDOWS\system32\TpKmpSvc.exe
C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
C:\WINDOWS\system32\wm.exe
C:\Program Files\Lenovo\System Update\SUService.exe
C:\Program Files\Common Files\Lenovo\Logger\logmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\ZOOM\TpScrex.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrobat_sl.exe
.
************************************************** ************************
.
Completion time: 2008-10-17 19:28:22 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-17 23:28:06
Pre-Run: 89,340,223,488 bytes free
Post-Run: 89,251,954,688 bytes free
255 --- E O F --- 2008-10-06 19:06:14