ComboFix 08-02-14.3 - Bill Duke 2008-02-15 2:10:04.2 - NTFSx86 Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Bill Duke\Desktop\cfscript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE C:\WINDOWS\system32\ggfhk.ini2 C:\WINDOWS\system32\mouse_configurator.win C:\WINDOWS\system32\winmgd.win C:\WINDOWS\system32\xxbay.bak1 C:\WINDOWS\system32\xxbay.bak2 . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\ggfhk.ini2 C:\WINDOWS\system32\xxbay.bak1 C:\WINDOWS\system32\xxbay.bak2 . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_DOMAINSERVICE ((((((((((((((((((((((((( Files Created from 2008-01-15 to 2008-02-15 ))))))))))))))))))))))))))))))) . 2008-02-14 03:03 . 2008-02-14 03:06 1,374 --a--c--- C:\WINDOWS\imsins.BAK 2008-02-13 23:12 . 2008-02-13 23:12 d----c--- C:\Documents and Settings\Bill Duke\Application Data\Malwarebytes 2008-02-13 23:11 . 2008-02-13 23:11 d----c--- C:\Program Files\Malwarebytes' Anti-Malware 2008-02-13 23:11 . 2008-02-13 23:11 d----c--- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-02-11 13:27 . 2008-02-11 13:27 d----c--- C:\Program Files\Enigma Software Group 2008-02-11 13:09 . 2008-02-11 13:09 d----c--- C:\Program Files\Safari 2008-02-11 01:30 . 2008-02-11 01:30 230 --a--c--- C:\WINDOWS\system32\spupdsvc.inf 2008-02-10 18:55 . 2008-02-15 02:22 54,156 --ah-c--- C:\WINDOWS\QTFont.qfn 2008-02-10 18:55 . 2008-02-10 18:55 1,409 --a--c--- C:\WINDOWS\QTFont.for 2008-02-08 23:40 . 2008-02-08 23:40 d----c--- C:\Program Files\Opera 2008-02-08 14:23 . 2007-07-30 19:19 207,736 --a--c--- C:\WINDOWS\system32\muweb.dll 2008-02-08 07:50 . 2008-02-08 07:50 d----c--- C:\WINDOWS\F34D9A5F484A4E31A9D3908CB265B289.TMP 2008-02-08 02:25 . 2008-02-10 22:52 121 --a--c--- C:\WINDOWS\bdagent.INI 2008-02-07 23:20 . 2008-02-07 23:20 d----c--- C:\Program Files\Trend Micro 2008-02-07 12:41 . 2008-02-07 12:41 0 --a--c--- C:\WINDOWS\system32\SBRC.dat 2008-02-07 12:41 . 2008-02-07 12:41 0 --a--c--- C:\WINDOWS\system32\SBFC.dat 2008-02-07 09:58 . 2008-02-07 09:58 d----c--- C:\Documents and Settings\Bill Duke\Application Data\Sunbelt Software 2008-02-07 08:24 . 2008-02-11 14:19 d----c--- C:\Program Files\Common Files\BitDefender 2008-02-07 07:51 . 2008-02-07 10:09 d----c--- C:\Documents and Settings\Bill Duke\.housecall6.6 2008-02-07 02:12 . 2008-02-07 02:12 d----c--- C:\Documents and Settings\Administrator\Application Data\Viewpoint 2008-02-05 15:49 . 2008-02-10 20:03 d----c--- C:\Program Files\ewido anti-malware . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-13 06:37 --------- dc----w C:\Program Files\EarthLink TotalAccess 2008-02-11 18:10 --------- dc----w C:\Documents and Settings\Bill Duke\Application Data\Apple Computer 2008-02-11 18:07 --------- dc----w C:\Program Files\Apple Software Update 2008-02-07 13:13 --------- dc----w C:\Program Files\America Online 9.0 2008-01-14 07:23 --------- dc----w C:\Documents and Settings\All Users\Application Data\AOL OCP 2008-01-14 07:21 --------- dc----w C:\Program Files\Common Files\AOL 2008-01-14 07:15 --------- dc----w C:\Documents and Settings\All Users\Application Data\AOL Downloads 2008-01-12 07:31 --------- dc----w C:\Program Files\Sygate 2008-01-12 05:24 --------- dc----w C:\Program Files\Common Files\Agnitum Shared 2008-01-08 08:15 --------- dc----w C:\Program Files\Java 2008-01-07 08:14 --------- dc----w C:\Program Files\COMODO 2008-01-07 08:14 --------- dc----w C:\Documents and Settings\All Users\Application Data\comodo 2008-01-07 07:34 --------- dc----w C:\Documents and Settings\Bill Duke\Application Data\Comodo 2008-01-07 06:07 --------- dc----w C:\Program Files\Common Files\Java(2) 2008-01-07 06:07 --------- dc----w C:\Program Files\Common Files\Java 2008-01-07 05:49 --------- dc----w C:\Program Files\Java(2) 2008-01-05 02:36 --------- dc----w C:\Program Files\Spybot - Search & Destroy 2008-01-05 02:34 --------- dc----w C:\Documents and Settings\Bill Duke\Application Data\Spyware Terminator 2008-01-05 02:34 --------- dc----w C:\Documents and Settings\All Users\Application Data\Spyware Terminator 2008-01-05 02:34 --------- dc----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-01-05 01:55 --------- dc----w C:\Program Files\Common Files\Wise Installation Wizard 2008-01-05 01:42 --------- dc----w C:\Program Files\Agnitum 2008-01-04 21:03 --------- dc----w C:\Documents and Settings\All Users\Application Data\{4C2CB1B6-C45E-4307-ACEE-27BE65138599} 2008-01-04 21:01 --------- dc----w C:\Program Files\Blaze Media Pro2 2008-01-04 01:03 --------- dc----w C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-01-02 21:47 --------- dc----w C:\Program Files\McAfee 2008-01-02 21:46 --------- dc----w C:\Program Files\Common Files\McAfee 2008-01-02 21:44 --------- dc----w C:\Documents and Settings\All Users\Application Data\McAfee 2008-01-02 20:01 --------- dc----w C:\Documents and Settings\Bill Duke\Application Data\AOL 2008-01-02 20:01 --------- dc----w C:\Documents and Settings\All Users\Application Data\AOL 2008-01-01 19:25 --------- dc----w C:\Program Files\Lavasoft 2008-01-01 16:18 --------- dc----w C:\Documents and Settings\Administrator\Application Data\Spyware Terminator 2007-12-20 03:09 --------- dc----w C:\Documents and Settings\Bill Duke\Application Data\Sibelius Software 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\RPRSTITL.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\RPRSTEXT.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\RPRSSTMP.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\RPRSSPEC.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\RPRSSCRP.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\RPRSREH_.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\RPRSMET_.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\RPRSCHOR.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\RPRS____.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\OPUSTEXT.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\OPUSSE__.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\OPUSS___.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\OPUSROMC.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\OPUSPC__.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\OPUSP___.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\OPUSO___.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\OPUSNN__.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\OPUSM___.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\OPUSJAPC.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\OPUSFS__.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\OPUSFBE_.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\OPUSFB__.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\OPUSCSC_.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\OPUSCS__.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\OPUSC___.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\OPUS____.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\INKPEN2_.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\INK2TEXT.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\INK2SPEC.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\INK2SCRI.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\INK2METR.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\INK2CHOR.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\HELST___.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\HELSS___.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\HELSM___.FOT 2007-12-20 03:08 1,409 -c--a-w C:\WINDOWS\Fonts\HELSINKI.FOT 2007-12-20 03:07 --------- dc----w C:\Program Files\Sibelius Software 2007-12-18 09:51 179,584 -c--a-w C:\WINDOWS\system32\drivers\mrxdav.sys 2007-12-07 01:07 659,456 -c--a-w C:\WINDOWS\system32\wininet.dll 2007-12-04 18:38 550,912 -c--a-w C:\WINDOWS\system32\oleaut32.dll 2007-06-11 01:00 461 -c--a-w C:\Program Files\Shortcut to iTunes.lnk 2007-05-29 06:27 5,477,161 -c--a-w C:\Program Files\Robin_Thicke-13-Lazy_Bones.mp3 2007-05-28 00:23 4,449,220 -c--a-w C:\Program Files\Jay-Z - Reasonable Doubt - 03 - Brooklyn's Finest feat. Biggie Smalls.mp3 2007-05-26 22:49 4,608,386 -c--a-w C:\Program Files\Gato Barbieri-Indonesia.mp3 2007-05-17 20:36 3,088,384 -c--a-w C:\Program Files\Spanish Guitar - DANZONES Y PASOS DOBLES - PASODOBLE JOSELITO.mp3 2006-01-19 14:22 18,160 -c--a-w C:\Documents and Settings\Bill Duke\Application Data\GDIPFONTCACHEV1.DAT 2005-05-11 01:54 86,528 -c-ha-w C:\Documents and Settings\Bill Duke\Application Data\rbap500.dll 2005-05-11 01:54 73,728 -c-ha-w C:\Documents and Settings\Bill Duke\Application Data\RBRegEx500.dll 2005-03-02 16:35 65,552 -c--a-w C:\Program Files\Tiger_heli.nes 2005-03-02 16:34 393,232 -c--a-w C:\Program Files\GI_joe.nes 2005-03-02 16:34 131,088 -c--a-w C:\Program Files\Megaman.nes 2005-03-02 16:33 524,304 -c--a-w C:\Program Files\Teenage_mutant_ninja_turtles3.nes 2005-03-01 03:24 524,304 -c--a-w C:\Program Files\castlevania3.nes 2005-03-01 03:21 262,160 -c--a-w C:\Program Files\Double_dragon2.nes 2005-03-01 03:21 131,088 -c--a-w C:\Program Files\jackal.nes 2005-03-01 03:21 131,088 -c--a-w C:\Program Files\Castlevania.nes 2005-03-01 03:20 65,680 -c--a-w C:\Program Files\friday_the_13th.nes 2005-02-28 07:33 131,088 -c--a-w C:\Program Files\who_framed_roger_rabbit.nes 2005-02-28 06:48 262,287 -c--a-w C:\Program Files\Ninja_gaiden.nes 2005-02-28 06:47 41,104 -c--a-w C:\Program Files\Track_and_field.nes 2005-02-28 06:46 262,160 -c--a-w C:\Program Files\Double_dragon.nes 2005-02-28 06:46 131,088 -c--a-w C:\Program Files\contra.nes 2005-02-28 06:45 393,232 -c--a-w C:\Program Files\Tecmo_super_bowl.nes 2005-02-28 06:44 41,104 -c--a-w C:\Program Files\excitebike.nes 2005-02-28 06:44 262,160 -c--a-w C:\Program Files\Tecmo_bowl.nes 2005-02-28 06:43 65,552 -c--a-w C:\Program Files\Ms_pacman.nes 2005-02-28 06:43 131,088 -c--a-w C:\Program Files\Double_dribble.nes . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2f3a22c2-3af0-4797-ac0f-eac7176984a0}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208] "E6TaskPanel"="C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" [2005-09-01 14:24 942080] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-28 11:14 270648] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 11:41 282624] "RegistryMechanic"="C:\Program Files\Registry Mechanic\RegMech.exe" [2006-10-30 15:12 2287152] "combofix"="C:\WINDOWS\system32\kmd.exe" [2004-08-04 02:56 388608] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-06-12 21:37:56 113664] America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2005-01-26 21:35:24 156784] AOL Companion.lnk - C:\Program Files\AOL Companion\companion.exe [2005-01-26 21:42:51 250992] HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-29 02:06:36 53248] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "SFCDisable"=dword:00000004 [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= "LoadAppInit_DLLs"=1 (0x1) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, R2 EarthLinkMonitor;EarthLink Monitor Service;"C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe" [2005-01-26 10:47] R3 Ptserlp;PCTEL Serial Device Driver for PCI;C:\WINDOWS\system32\DRIVERS\ptserlp.sys [2001-08-17 08:28] S3 BW2NDIS5;BW2NDIS5;C:\WINDOWS\system32\Drivers\BW2NDIS5.sys [2004-11-01 13:16] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{00c27897-3fe5-11dc-a9fd-00038a000015}] \Shell\AutoRun\command - F:\Autorun.exe /run \Shell\Shell00\Command - F:\Autorun.exe /run \Shell\Shell01\Command - F:\Autorun.exe /action \Shell\Shell02\Command - F:\Autorun.exe /uninstall . Contents of the 'Scheduled Tasks' folder "2008-02-08 15:33:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-15 02:23:29 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Sygate\SPF\smc.exe C:\WINDOWS\System32\brss01a.exe C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\System32\cisvc.exe C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\Program Files\mcafee.com\personal firewall\MPFService.exe C:\WINDOWS\system32\pctspk.exe C:\WINDOWS\System32\HPZipm12.exe C:\Program Files\Seagate\Sync\SeaSyncServices.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\system32\YPCSER~1.EXE C:\WINDOWS\system32\wscntfy.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\cidaemon.exe . ************************************************************************** . Completion time: 2008-02-15 2:33:22 - machine was rebooted ComboFix-quarantined-files.txt 2008-02-15 07:33:18 ComboFix2.txt 2008-02-14 17:44:05 . 2008-02-14 08:14:16 --- E O F ---