ComboFix 08-02.05.3 - sseeburger 2008-02-07 9:46:07.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.390 [GMT -5:00] Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\nnljj.dll C:\WINDOWS\system32\pneozlty.dll C:\WINDOWS\system32\tuvwusq.dll C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat C:\Program Files\Common Files\{CC512~1 C:\WINDOWS\cookies.ini C:\WINDOWS\setup.exe C:\WINDOWS\system32\cavvlfrs.ini C:\WINDOWS\system32\components C:\WINDOWS\system32\ctictton.ini C:\WINDOWS\system32\domkyehi.dllbox C:\WINDOWS\system32\drivers\fad.sys C:\WINDOWS\system32\eexjwpeg.ini C:\WINDOWS\system32\esgyrpuy.dll C:\WINDOWS\system32\FDB9921789.dll C:\WINDOWS\system32\gepwjxee.dll C:\WINDOWS\system32\giltifku.ini C:\WINDOWS\system32\gwoqxmsn.dll C:\WINDOWS\system32\hixlbbmy.dll C:\WINDOWS\system32\jjlnn.ini C:\WINDOWS\system32\jjlnn.ini2 C:\WINDOWS\system32\juivbcru.dll C:\WINDOWS\system32\kajkwypb.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\nnljj.dll C:\WINDOWS\system32\osmtiraw.dll C:\WINDOWS\system32\phcymnbh.dllbox C:\WINDOWS\system32\pneozlty.dll C:\WINDOWS\system32\pneozlty.dllbox C:\WINDOWS\system32\srflvvac.dll C:\WINDOWS\system32\toiwcipv.dll C:\WINDOWS\system32\tuvwusq.dll ----- BITS: Possible infected sites ----- hxxp://chaswsus1 . ((((((((((((((((((((((((( Files Created from 2008-01-07 to 2008-02-07 ))))))))))))))))))))))))))))))) . 2008-02-07 09:39 . 2004-08-03 23:00 260,272 --a--c--- C:\cmldr 2008-02-07 09:15 . 2004-08-04 00:56 388,608 --a------ C:\kmd.exe 2008-02-07 09:04 . 2008-02-07 09:04 d-------- C:\Program Files\CCleaner 2008-02-06 10:56 . 2008-02-06 10:56 d-------- C:\Documents and Settings\sseeburger\Application Data\HouseCall 6.6 2008-02-06 10:55 . 2008-02-06 10:55 d-------- C:\WINDOWS\system32\HouseCall 6.6 2008-02-06 10:49 . 2008-02-06 10:49 d-------- C:\Documents and Settings\sseeburger\Application Data\TrojanHunter 2008-02-06 10:44 . 2008-02-06 10:45 d-------- C:\Program Files\TrojanHunter 5.0 2008-02-06 09:22 . 2008-02-06 09:22 d-------- C:\Program Files\Spybot - Search & Destroy 2008-02-06 09:22 . 2008-02-06 09:26 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-02-06 07:33 . 2008-02-06 07:34 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-02-06 07:04 . 2008-02-06 07:15 2,878 --a------ C:\WINDOWS\system32\tmp.reg 2008-02-01 11:32 . 2008-02-04 06:08 d-------- C:\WINDOWS\SxsCaPendDel 2008-01-22 13:24 . 2008-01-22 13:24 d-------- C:\WINDOWS\system32\NtmsData 2008-01-11 11:32 . 2007-12-10 11:12 3,798,071 --a------ C:\WINDOWS\FramePkg.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-07 15:44 --------- d-----w C:\Documents and Settings\sseeburger\Application Data\SoftGrid Client 2008-02-07 14:17 1,668 ----a-w C:\RMS4.reg 2008-02-06 12:34 --------- d-----w C:\Program Files\Lavasoft 2008-02-06 12:32 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-02-05 12:28 --------- d-----w C:\Program Files\Trend Micro 2008-02-01 16:50 --------- d-----w C:\Program Files\Xilisoft 2008-02-01 16:38 --------- d-----w C:\Program Files\CyberLink 2008-02-01 16:32 --------- d-----w C:\Program Files\Nokia 2008-02-01 16:32 --------- d-----w C:\Program Files\Common Files\Nokia 2008-02-01 16:25 --------- d-----w C:\Program Files\Microsoft.NET 2008-02-01 15:55 --------- d-----w C:\Program Files\Joost 2008-02-01 15:54 --------- d-----w C:\Program Files\Microsoft ActiveSync 2008-02-01 15:49 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-01 15:48 --------- d-----w C:\Program Files\DivX 2008-02-01 15:43 --------- d-----w C:\Program Files\Common Files\Research In Motion 2008-01-29 14:26 --------- d-----w C:\Program Files\SKTools 2008-01-29 11:57 --------- d-----w C:\Program Files\Resco 2008-01-21 11:53 --------- d-----w C:\Program Files\Research In Motion 2008-01-17 15:42 --------- d-----w C:\Documents and Settings\sseeburger\Application Data\Image Zone Express 2008-01-16 15:25 --------- d-----w C:\Program Files\Java 2008-01-11 16:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee 2007-09-06 15:16 92,064 -c--a-w C:\Documents and Settings\sseeburger\mqdmmdm.sys 2007-09-06 15:16 9,232 -c--a-w C:\Documents and Settings\sseeburger\mqdmmdfl.sys 2007-09-06 15:16 79,328 -c--a-w C:\Documents and Settings\sseeburger\mqdmserd.sys 2007-09-06 15:16 66,656 -c--a-w C:\Documents and Settings\sseeburger\mqdmbus.sys 2007-09-06 15:16 6,208 -c--a-w C:\Documents and Settings\sseeburger\mqdmcmnt.sys 2007-09-06 15:16 5,936 -c--a-w C:\Documents and Settings\sseeburger\mqdmwhnt.sys 2007-09-06 15:16 4,048 -c--a-w C:\Documents and Settings\sseeburger\mqdmcr.sys 2007-09-06 15:16 25,600 -c--a-w C:\Documents and Settings\sseeburger\usbsermptxp.sys 2007-09-06 15:16 22,768 -c--a-w C:\Documents and Settings\sseeburger\usbsermpt.sys 2006-02-19 07:28 12,288 -c--a-w C:\WINDOWS\Fonts\RandFont.dll 2005-05-13 21:12 217,073 -csha-r C:\WINDOWS\meta4.exe 2005-10-24 15:13 66,560 -csha-r C:\WINDOWS\MOTA113.exe 2005-10-14 01:27 422,400 -csha-r C:\WINDOWS\x2.64.exe 2005-07-14 16:31 27,648 -csha-r C:\WINDOWS\system32\AVSredirect.dll 2005-06-26 19:32 616,448 -csha-r C:\WINDOWS\system32\cygwin1.dll 2005-06-22 02:37 45,568 -csha-r C:\WINDOWS\system32\cygz.dll 2004-01-25 04:00 70,656 -csha-r C:\WINDOWS\system32\i420vfw.dll 2006-07-28 02:16 209,695 -csha-w C:\WINDOWS\system32\kklnn.bak1 2006-08-06 20:39 495,846 -csha-w C:\WINDOWS\system32\kklnn.bak2 2006-04-27 14:24 2,945,024 -csha-r C:\WINDOWS\system32\Smab.dll 2005-02-28 17:16 240,128 -csha-r C:\WINDOWS\system32\x.264.exe 2004-01-25 04:00 70,656 --sha-r C:\WINDOWS\system32\yv12vfw.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89A1E40D-0254-4F99-B9AE-B60A2D8754A9}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F6DC9BA2-9D88-401E-83AF-FC16A9160F82}] C:\WINDOWS\system32\efcay.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-29 07:10 68856] "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-03-09 13:32 67128] "ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 03:40 218032] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 13:39 1289000] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-12 20:00 344064] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-04-14 10:52 602182] "ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2007-10-16 20:50 111952] "Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 19:52 483328] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 14:32 56080 C:\WINDOWS\KHALMNPR.Exe] "SoftGridTray"="C:\Program Files\Softricity\SoftGrid for Windows Desktops\SFTTray.exe" [2007-07-30 17:50 308592] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-08-24 20:25 185632] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360] "McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2007-12-10 11:11 136512] "THGuard"="C:\Program Files\TrojanHunter 5.0\THGuard.exe" [2007-09-09 09:31 1046688] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2007-04-19 07:45:11 25214] Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-04-12 09:37:48 643133] Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-03-09 13:32:55 67128] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-06-27 12:23:36 692224] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "HideStartupScripts"= 0 (0x0) "RunLogonScriptSync"= 1 (0x1) "RunStartupScriptSync"= 0 (0x0) "MaxGPOScriptWait"= 300 (0x12c) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "RunLogonScriptSync"= 1 (0x1) "HideLogonScripts"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\[u]0[/u]\[u]0[/u]] "Script"=AtlysUpgradeSU.vbs [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\1\[u]0[/u]] "Script"=Startup.vbs [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\1\1] "Script"=UpgradeCM.vbs [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\1\2] "Script"=Deploy WW Scr.vbs [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\1\3] "Script"=mcafee5200.vbs [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\2\[u]0[/u]] "Script"=Softgrid Startup.vbs [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1942907249-477984267-879972363-32947\Scripts\Logon\[u]0[/u]\[u]0[/u]] "Script"=Logon.vbs [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1942907249-477984267-879972363-32947\Scripts\Logon\[u]0[/u]\1] "Script"=RegistryUpdates.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1942907249-477984267-879972363-32947\Scripts\Logon\[u]0[/u]\2] "Script"=UserDNS.vbs [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1942907249-477984267-879972363-32947\Scripts\Logon\[u]0[/u]\3] "Script"=VPNChange.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3107053558-405287426-2233412508-7529\Scripts\Logon\[u]0[/u]\[u]0[/u]] "Script"=Logon.vbs [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3107053558-405287426-2233412508-7529\Scripts\Logon\[u]0[/u]\1] "Script"=RegistryUpdates.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3107053558-405287426-2233412508-7529\Scripts\Logon\[u]0[/u]\2] "Script"=VPNChange.bat [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk backup=C:\WINDOWS\pss\HP Photosmart Premier Fast Start.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Trend Micro Anti-Spyware.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Trend Micro Anti-Spyware.lnk backup=C:\WINDOWS\pss\Trend Micro Anti-Spyware.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^sseeburger^Start Menu^Programs^Startup^palmOne Registration.lnk] path=C:\Documents and Settings\sseeburger\Start Menu\Programs\Startup\palmOne Registration.lnk backup=C:\WINDOWS\pss\palmOne Registration.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^sseeburger^Start Menu^Programs^Startup^Yahoo! Widget Engine.lnk] path=C:\Documents and Settings\sseeburger\Start Menu\Programs\Startup\Yahoo! Widget Engine.lnk backup=C:\WINDOWS\pss\Yahoo! Widget Engine.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] --a--c--- 2003-08-20 20:24 151552 C:\Program Files\Apoint\Apoint.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bascstray] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent] --a------ 2004-08-04 00:56 110592 C:\WINDOWS\system32\bthprops.cpl [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 00:56 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent] --a------ 2006-11-13 13:39 1289000 C:\Program Files\Microsoft ActiveSync\wcescomm.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a--c--- 2006-02-19 01:41 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig] --a--c--- 2006-04-14 10:51 667718 C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer] --a------ 2007-04-11 14:32 56080 C:\WINDOWS\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI] --a--c--- 2005-02-25 14:50 139320 C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a--c--- 2006-06-16 13:38 5324584 C:\Program Files\MSN Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBCUniversal Media Manager Tray] C:\Program Files\Entriq\MediaSphere\Bin\EntriqMediaTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a--c--- 2006-01-12 16:40 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2007-06-18 15:10 271360 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync] --a------ 2007-06-19 10:17 1241088 C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE] --a--c--- 2003-02-24 15:35 163840 C:\WINDOWS\system32\pctspk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra--c--- 2007-02-20 12:06 741376 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundService] C:\WINDOWS\system32\kgrfoyqb.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StreamServerPro] --a--c--- 2006-06-22 07:18 126976 C:\Program Files\Pocket Stream Server\StreamServer Pro.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2007-08-24 20:25 185632 C:\Program Files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\True Connect] --a--c--- 2006-04-20 18:46 147456 C:\Program Files\Raspberry Software\True Connect\TrueConnect.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "RichVideo"=2 (0x2) "iPodService"=3 (0x3) "gusvc"=3 (0x3) "BlueSoleil Hid Service"=2 (0x2) R2 sftlist;SoftGrid Client;"C:\Program Files\Softricity\SoftGrid for Windows Desktops\sftlist.exe" [2007-07-30 17:50] R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2006-11-28 09:16] R3 GTIPCI21;GTIPCI21;C:\WINDOWS\system32\DRIVERS\gtipci21.sys [2005-05-31 10:46] R3 sftfs;sftfs;C:\Program Files\Softricity\SoftGrid for Windows Desktops\drivers\sftfsXP.sys [2007-07-30 17:50] R3 sftplay;sftplay;C:\Program Files\Softricity\SoftGrid for Windows Desktops\drivers\sftplayXP.sys [2007-07-30 17:49] R3 sftvol;sftvol;C:\Program Files\Softricity\SoftGrid for Windows Desktops\drivers\sftvolXP.sys [2007-07-30 17:49] R3 sftvsa;SoftGrid Virtual Service Agent;"C:\Program Files\Softricity\SoftGrid for Windows Desktops\sftvsa.exe" [2007-07-30 17:49] S3 atimtai;atimtai;C:\WINDOWS\system32\DRIVERS\atimtai.sys [2001-08-17 11:48] S3 BTCFilterService;USB Networking Driver Filter Service;C:\WINDOWS\system32\DRIVERS\motfilt.sys [2007-01-23 20:36] S3 BTNetFilter;Bluetooth Network Filter;C:\WINDOWS\system32\drivers\BTNetFilter.sys [2004-12-16 15:32] S3 EL556ND5;3Com 10/100 MiniPCI Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\EL556ND5.sys [2001-08-17 11:10] S3 maestro;ESS Maestro 3 Audio Driver (WDM);C:\WINDOWS\system32\drivers\es198x.sys [2001-08-17 11:19] S3 motccgp;Motorola USB Composite Device Driver;C:\WINDOWS\system32\DRIVERS\motccgp.sys [2007-06-18 14:19] S3 motccgpfl;MotCcgpFlService;C:\WINDOWS\system32\DRIVERS\motccgpfl.sys [2007-01-23 18:03] S3 Motousbnet;Motorola USB Networking Driver Service;C:\WINDOWS\system32\DRIVERS\Motousbnet.sys [2007-01-23 20:36] S3 MSControlService;Microsoft cache control;C:\WINDOWS\system32\windows [] S3 O2SCBUS;O2Micro SmartCardBus Reader;C:\WINDOWS\system32\DRIVERS\ozscr.sys [2002-11-08 13:13] S3 OracleRMSClientCache;OracleRMSClientCache;C:\Oracle\BIN\ONRSD.EXE [2001-12-15 01:48] S3 PCMCIA_WIRELESS_MODEM;PCMCIA_WIRELESS_MODEM;C:\WINDOWS\system32\DRIVERS\pcmciadrv.sys [2004-06-07 15:38] S3 SE30bus;Sony Ericsson Device 048 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\SE30bus.sys [2006-05-01 13:51] S3 SE30mdfl;Sony Ericsson Device 048 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\SE30mdfl.sys [2006-05-01 13:52] S3 SE30mdm;Sony Ericsson Device 048 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\SE30mdm.sys [2006-05-01 13:52] S3 SE30mgmt;Sony Ericsson Device 048 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\SE30mgmt.sys [2006-05-01 13:53] S3 se30nd5;Sony Ericsson Device 048 USB Ethernet Emulation SEMC48 (NDIS);C:\WINDOWS\system32\DRIVERS\se30nd5.sys [2006-05-15 08:45] S3 SE30obex;Sony Ericsson Device 048 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\SE30obex.sys [2006-05-01 13:54] S3 se30unic;Sony Ericsson Device 048 USB Ethernet Emulation SEMC48 (WDM);C:\WINDOWS\system32\DRIVERS\se30unic.sys [2006-05-01 13:51] S3 SE31bus;Sony Ericsson Device 049 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\SE31bus.sys [2006-05-01 06:56] S3 SE31mdfl;Sony Ericsson Device 049 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\SE31mdfl.sys [2006-05-01 06:57] S3 SE31mdm;Sony Ericsson Device 049 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\SE31mdm.sys [2006-05-01 06:57] S3 SE31mgmt;Sony Ericsson Device 049 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\SE31mgmt.sys [2006-05-01 06:58] S3 se31nd5;Sony Ericsson Device 049 USB Ethernet Emulation SEMC49 (NDIS);C:\WINDOWS\system32\DRIVERS\se31nd5.sys [2006-05-01 06:56] S3 SE31obex;Sony Ericsson Device 049 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\SE31obex.sys [2006-05-01 06:59] S3 se31unic;Sony Ericsson Device 049 USB Ethernet Emulation SEMC49 (WDM);C:\WINDOWS\system32\DRIVERS\se31unic.sys [2006-05-01 06:56] S3 se46bus;Sony Ericsson Device 070 driver (WDM);C:\WINDOWS\system32\DRIVERS\se46bus.sys [2006-07-25 16:38] S3 se46mdfl;Sony Ericsson Device 070 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\se46mdfl.sys [2006-11-30 15:11] S3 se46mdm;Sony Ericsson Device 070 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\se46mdm.sys [2006-11-30 15:11] S3 se46mgmt;Sony Ericsson Device 070 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\se46mgmt.sys [2006-07-25 16:40] S3 se46nd5;Sony Ericsson Device 070 USB Ethernet Emulation SEMC46 (NDIS);C:\WINDOWS\system32\DRIVERS\se46nd5.sys [2006-07-25 16:38] S3 se46obex;Sony Ericsson Device 070 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\se46obex.sys [2006-07-25 16:41] S3 se46unic;Sony Ericsson Device 070 USB Ethernet Emulation SEMC46 (WDM);C:\WINDOWS\system32\DRIVERS\se46unic.sys [2006-07-25 16:37] S3 SideWnd;SideWnd;C:\WINDOWS\system32\DRIVERS\innvmini.sys [2005-09-29 15:04] S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\w300bus.sys [2006-03-13 15:49] S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w300mdfl.sys [2006-03-13 15:50] S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w300mdm.sys [2006-03-13 15:50] S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w300mgmt.sys [2005-12-28 11:48] S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w300obex.sys [2005-12-28 11:49] S3 WDHAALBA;WDHAALBAMiniPCI Winmodem;C:\WINDOWS\system32\DRIVERS\WDHAALBA.sys [2001-08-17 12:28] S3 z520bus;Sony Ericsson 520 driver (WDM);C:\WINDOWS\system32\DRIVERS\z520bus.sys [2005-07-26 10:13] S3 z520mdfl;Sony Ericsson 520 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\z520mdfl.sys [2005-07-26 10:15] S3 z520mdm;Sony Ericsson 520 USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\z520mdm.sys [2005-07-26 10:15] S3 z520mgmt;Sony Ericsson 520 USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\z520mgmt.sys [2005-07-26 10:16] S3 z520obex;Sony Ericsson 520 USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\z520obex.sys [2005-07-26 10:18] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-07 10:44:20 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\System32\SCardSvr.exe C:\WINDOWS\system32\basfipm.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe c:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\McAfee\Common Framework\FrameworkService.exe C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\McAfee\Common Framework\naPrdMgr.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZipm12.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\ORL\VNC\WinVNC.exe C:\WINDOWS\system32\msiexec.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Softricity\SoftGrid for Windows Desktops\sftdcc.exe C:\Program Files\McAfee\Common Framework\McTray.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\Program Files\PC Connectivity Solution\NclBTHandler.exe C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE . ************************************************************************** . Completion time: 2008-02-07 10:48:18 - machine was rebooted ComboFix-quarantined-files.txt 2008-02-07 15:48:13 . 2008-02-06 15:15:22 --- E O F ---