ComboFix 08-02.05.3 - MAPepin 2008-02-07 15:00:31.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1568 [GMT -5:00] Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\MAPepin\Desktop\CFScript.txt * Created a new restore point FILE C:\WINDOWS\system32\adsldpv.exe C:\WINDOWS\system32\drivers\symavc32.sys . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\adsldpv.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_SSDPSRVBITS -------\LEGACY_UPNPHOSTPOLICYAGENT -------\LEGACY_WMIAPSRVASPNET_STATE -------\SSDPSRVBITS -------\upnphostPolicyAgent -------\WmiApSrvaspnet_state ((((((((((((((((((((((((( Files Created from 2008-01-07 to 2008-02-07 ))))))))))))))))))))))))))))))) . 2008-02-07 14:17 . 2008-02-07 14:17 d-------- C:\Program Files\Common Files\NSV 2008-02-07 14:16 . 2004-08-03 23:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys 2008-02-07 14:16 . 2004-08-03 23:07 59,264 --a------ C:\WINDOWS\system32\dllcache\usbaudio.sys 2008-02-07 14:16 . 2004-08-04 00:56 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2008-02-07 14:16 . 2004-08-04 00:56 21,504 --a------ C:\WINDOWS\system32\dllcache\hidserv.dll 2008-02-07 14:12 . 2008-02-07 14:13 d-------- C:\WINDOWS\LastGood.Tmp 2008-02-07 14:12 . 2008-02-07 14:13 d-------- C:\Program Files\Winamp 2008-02-07 14:12 . 2008-02-07 14:53 d-------- C:\Documents and Settings\MAPepin\Application Data\Winamp 2008-02-07 13:33 . 2008-02-07 13:33 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-02-07 13:33 . 2008-02-07 13:33 d-------- C:\Documents and Settings\MAPepin\Application Data\Malwarebytes 2008-02-07 13:33 . 2008-02-07 13:33 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-02-07 07:47 . 2008-02-07 07:50 d-------- C:\Program Files\Windows Live Safety Center 2008-02-06 17:52 . 2004-08-04 06:00 388,608 --a------ C:\kmd.exe 2008-02-06 17:24 . 2008-02-06 17:24 d-------- C:\Program Files\Java 2008-02-06 17:24 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-02-06 17:22 . 2008-02-06 17:22 d-------- C:\Program Files\Common Files\Java 2008-02-06 14:30 . 2008-02-06 17:54 d-------- C:\ComboFix_a 2008-02-06 14:21 . 2004-08-04 05:00 260,272 -r-hs---- C:\cmldr 2008-02-06 14:03 . 2008-02-07 10:16 32 --a-s---- C:\WINDOWS\system32\2316743137.dat 2008-02-06 14:00 . 2008-02-06 14:00 d-------- C:\WINDOWS\ERUNT 2008-02-06 13:57 . 2008-02-06 14:06 d-------- C:\SDFix 2008-02-05 14:21 . 2008-02-07 13:27 0 --a------ C:\reg.reg 2008-02-04 09:38 . 2008-02-06 08:50 d-------- C:\Program Files\a-squared Anti-Malware 2008-02-04 09:18 . 2008-02-06 08:50 d-------- C:\Program Files\a-squared Free 2008-02-04 08:45 . 2008-02-04 08:45 376 --a------ C:\WINDOWS\ODBC.INI 2008-02-04 07:38 . 2008-02-06 08:53 d-------- C:\Program Files\Opera 2008-02-01 12:02 . 2006-10-26 19:58 30,512 --a------ C:\WINDOWS\system32\mdimon.dll 2008-02-01 11:58 . 2008-02-01 11:58 d-------- C:\WINDOWS\IIS Temporary Compressed Files 2008-02-01 11:58 . 2008-02-01 11:58 0 --a------ C:\WINDOWS\frontpg.ini 2008-02-01 10:56 . 2008-02-01 10:56 d-------- C:\WINDOWS\Downloaded Installations 2008-02-01 10:56 . 2003-06-25 16:05 266,360 --a------ C:\WINDOWS\system32\TweakUI.exe 2008-02-01 10:56 . 2002-06-21 15:09 160,217 --a------ C:\WINDOWS\system32\PowerToysLicense.rtf 2008-01-29 11:29 . 2008-02-06 13:03 d-------- C:\Program Files\CCleaner 2008-01-29 10:57 . 2008-02-05 10:26 8,388,671 --a------ C:\WINDOWS\pfirewall.log.old 2008-01-29 08:15 . 2008-01-29 08:15 d-------- C:\Documents and Settings\MAPepin\Application Data\DivX 2008-01-29 08:01 . 2008-01-04 16:58 120,056 --------- C:\WINDOWS\system32\pxcpyi64.exe 2008-01-29 08:01 . 2008-01-04 16:58 118,520 --------- C:\WINDOWS\system32\pxinsi64.exe 2008-01-29 08:00 . 2008-01-29 08:01 d-------- C:\Program Files\DivX 2008-01-28 15:06 . 2008-01-28 15:06 d-------- C:\Program Files\SIW 2008-01-28 13:20 . 2008-02-05 14:29 d-------- C:\Documents and Settings\MAPepin\Application Data\OpenOffice.org2 2008-01-28 12:27 . 2008-01-28 12:27 d-------- C:\Program Files\Trend Micro 2008-01-26 15:08 . 2008-01-26 15:08 d--h----- C:\WINDOWS\system32\GroupPolicy 2008-01-26 14:20 . 2008-01-26 14:20 206 --a------ C:\WINDOWS\system32\MRT.INI 2008-01-26 13:11 . 2008-01-26 13:12 d-------- C:\WINDOWS\system32\NtmsData 2008-01-26 12:41 . 2007-08-01 22:47 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2008-01-26 11:52 . 2008-01-26 12:44 d-------- C:\Documents and Settings\MAPepin\.housecall6.6 2008-01-26 11:51 . 2008-01-26 11:51 d-------- C:\WINDOWS\Sun 2008-01-26 11:36 . 2008-01-29 08:57 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-01-24 16:40 . 2008-01-29 07:52 d-------- C:\Documents and Settings\MAPepin\Application Data\XnView 2008-01-22 15:28 . 2008-02-06 08:52 d-------- C:\Program Files\OpenOffice.org 2.3 2008-01-19 03:02 . 2006-08-21 04:14 128,896 --------- C:\WINDOWS\system32\dllcache\fltmgr.sys 2008-01-19 03:02 . 2006-08-21 04:14 23,040 --------- C:\WINDOWS\system32\dllcache\fltmc.exe 2008-01-19 03:02 . 2006-08-21 07:21 16,896 --------- C:\WINDOWS\system32\dllcache\fltlib.dll 2008-01-19 03:01 . 2008-01-19 03:01 d-------- C:\Program Files\MSXML 4.0 2008-01-18 17:13 . 2008-01-18 17:13 d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\Monotype Imaging 2008-01-18 17:13 . 2008-01-18 17:13 d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\Dell 2008-01-18 16:43 . 2008-01-18 16:43 d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage 2008-01-18 13:43 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys 2008-01-18 09:56 . 2008-01-18 09:56 d---s---- C:\Documents and Settings\MAPepin\UserData 2008-01-18 08:51 . 2008-01-18 08:51 d-------- C:\Documents and Settings\MAPepin\Application Data\Monotype Imaging 2008-01-18 08:42 . 2008-01-18 08:42 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2008-01-18 08:33 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-01-18 08:33 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-01-18 08:33 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-01-18 07:39 . 2007-07-09 08:09 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll 2008-01-17 17:46 . 2008-01-18 09:05 d-------- C:\Documents and Settings\MAPepin\Application Data\Yahoo! 2008-01-17 17:44 . 2008-01-17 17:44 d-------- C:\WINDOWS\Motive 2008-01-17 17:44 . 2008-01-17 17:45 d-------- C:\Program Files\SBC Self Support Tool 2008-01-17 17:44 . 2008-01-17 17:44 d-------- C:\Program Files\Common Files\Motive 2008-01-17 17:44 . 2008-01-17 17:44 d-------- C:\Documents and Settings\All Users\Application Data\Motive 2008-01-17 17:44 . 2005-05-10 01:36 81,920 --------- C:\WINDOWS\system32\W32n50.dll 2008-01-17 17:44 . 2005-05-10 01:36 17,162 --------- C:\WINDOWS\system32\Pcandis5.sys 2008-01-17 17:44 . 2005-05-10 01:36 16,848 --------- C:\WINDOWS\system32\Pcandis4.sys 2008-01-17 17:44 . 2005-05-10 01:36 16,073 --------- C:\WINDOWS\system32\Pcandis3.vxd 2008-01-17 17:42 . 2008-01-17 17:42 d-------- C:\Documents and Settings\MAPepin\Application Data\ScanSoft 2008-01-17 17:33 . 2008-01-18 14:36 d-------- C:\Documents and Settings\All Users\Application Data\yahoo! 2008-01-17 17:33 . 2002-01-05 07:37 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll 2008-01-17 17:33 . 2002-01-05 06:18 84,992 --a------ C:\WINDOWS\system32\ATL70.DLL 2008-01-17 17:33 . 2001-10-11 11:26 65,536 --a------ C:\WINDOWS\system32\YCRWin32.dll 2008-01-17 17:11 . 2008-01-17 17:46 d-------- C:\Program Files\Yahoo! 2008-01-17 17:07 . 2008-01-17 17:07 d-------- C:\Program Files\BroadJump 2008-01-17 16:41 . 2008-01-17 16:41 d-------- C:\Documents and Settings\LocalService\Application Data\Monotype Imaging 2008-01-17 16:41 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-01-17 16:41 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys 2008-01-17 16:41 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-01-17 16:41 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys 2008-01-17 16:21 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-01-17 16:21 . 2008-01-17 16:21 4,128 --a------ C:\INFCACHE.1 2008-01-17 15:55 . 2001-08-17 13:58 19,200 --a------ C:\WINDOWS\system32\drivers\hidbatt.sys 2008-01-17 15:55 . 2001-08-17 13:58 19,200 --a------ C:\WINDOWS\system32\dllcache\hidbatt.sys 2008-01-17 15:55 . 2001-08-17 13:57 14,080 --a------ C:\WINDOWS\system32\drivers\battc.sys 2008-01-17 15:55 . 2001-08-17 13:57 14,080 --a------ C:\WINDOWS\system32\dllcache\battc.sys 2008-01-17 15:55 . 2001-08-17 13:58 9,344 --a------ C:\WINDOWS\system32\drivers\compbatt.sys 2008-01-17 15:55 . 2001-08-17 13:58 9,344 --a------ C:\WINDOWS\system32\dllcache\compbatt.sys 2008-01-17 14:42 . 2008-01-15 22:27 d-------- C:\Documents and Settings\MAPepin\Application Data\InstallShield 2008-01-17 14:41 . 2008-01-15 22:27 d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\InstallShield 2008-01-17 14:34 . 2004-08-03 23:58 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys 2008-01-17 14:34 . 2001-08-17 14:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys 2008-01-17 14:34 . 2001-08-17 15:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2008-01-17 14:34 . 2008-01-17 14:34 8,192 --a------ C:\WINDOWS\REGLOCS.OLD . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-16 03:08 6,903 ----a-w C:\WINDOWS\system32\drivers\1028_Dell_OPT_755.mrk 2008-01-04 21:58 43,528 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- C:\WINDOWS\twain_32\DELL\MFP1125\Monitor\Stsmon.exe ---- Company: Dell Corporation. File Description: Dell MFP 1125 Stsmon.exe(English) File Version: 1, 1, 0, 0 Product Name: Dell MFP 1125 Copyright: Copyright (C) 2007 Dell Corporation. All Rights Reserved. Original file name: Stsmon.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-06-28 16:21 141848] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-06-28 16:21 162328] "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-06-28 16:21 137752] "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 10:03 210472] "PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2007-03-14 12:31 30248] "IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2007-03-14 12:29 46632] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-07-26 20:03 178712] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50 221184] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 17:15 81920] "RoxioDragToDisc"="C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 10:00 1116920] "PDVDDXSrv"="C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 18:23 118784] "Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 23:46 624248] "Acrobat Speed Launch"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrobat_sl.exe" [2006-10-23 02:40 46200] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 22:33 582992] "MFPMonitor"="C:\WINDOWS\twain_32\DELL\MFP1125\Monitor\Stsmon.exe" [2007-07-22 16:10 2002944] "BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 21:26 368706] "YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 16:19 129536] "Motive SmartBridge"="C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [2005-08-24 07:51 442455] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-09-24 20:12 1036288] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-15 17:54 37376] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ SBC Self Support Tool.lnk - C:\Program Files\SBC Self Support Tool\bin\matcli.exe [2008-01-17 17:44:25 217088] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, R1 DLARTL_M;DLARTL_M;C:\WINDOWS\system32\Drivers\DLARTL_M.SYS [2006-08-11 11:35] R2 ASFAgent;ASF Agent;C:\Program Files\Intel\ASF Agent\ASFAgent.exe [2007-01-23 04:58] R2 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);"c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" [2007-02-10 05:29] R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-04 06:00] R2 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [2007-02-10 05:29] S3 AsfAlrt;AsfAlrt Service;C:\WINDOWS\system32\Drivers\AsfAlrt.sys [2007-01-23 04:45] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{814033b0-c88b-11dc-b481-001aa0ea5509}] \Shell\AutoRun\command - E:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f9168a98-d3f9-11dc-b497-001aa0ea5509}] \Shell\AutoRun\command - E:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe *Newly Created Service* - UMWDF . Contents of the 'Scheduled Tasks' folder "2008-01-16 03:35:09 C:\WINDOWS\Tasks\McDefragTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe' "2008-01-16 03:35:08 C:\WINDOWS\Tasks\McQcTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-07 15:02:53 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\igfxsrvc.exe C:\PROGRA~1\Yahoo!\browser\ycommon.exe C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\McAfee\MSK\MskSrver.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroDist.exe . ************************************************************************** . Completion time: 2008-02-07 15:03:51 - machine was rebooted ComboFix-quarantined-files.txt 2008-02-07 20:03:48 ComboFix2.txt 2008-02-07 18:31:07 ComboFix3.txt 2008-02-06 19:35:39 . 2008-02-05 22:14:06 --- E O F ---