ComboFix 08-05-29.1 - Reception1 Admin 2008-05-30 12:05:56.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.629 [GMT 1:00] Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\Downloaded Program Files\USCR_0001_N10M0402NetInstaller.exe C:\WINDOWS\system32\appcert C:\WINDOWS\system32\d3eima.dll C:\WINDOWS\system32\drivers\byodysng.dat C:\WINDOWS\system32\d3dima.dll . . . . failed to delete C:\WINDOWS\system32\d3drmh.dll . . . . failed to delete . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_CWMESSRB -------\Legacy_GXDIFSSA -------\Service_cwmessrb -------\Service_gxdifssa ((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-30 ))))))))))))))))))))))))))))))) . 2008-05-30 10:25 . 2008-05-30 10:25 d-------- C:\Program Files\Opera 2008-05-20 10:16 . 2008-05-20 10:16 d-------- C:\Documents and Settings\Reception1 Admin\Application Data\Nokia Multimedia Player 2008-05-20 10:12 . 2008-05-23 14:34 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-20 10:12 . 2008-05-20 10:12 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-19 12:37 . 2008-05-19 12:37 d-------- C:\focus 2008-05-14 11:11 . 2008-05-20 10:28 244 --ah----- C:\sqmnoopt19.sqm 2008-05-14 11:11 . 2008-05-20 10:28 232 --ah----- C:\sqmdata19.sqm 2008-05-13 11:55 . 2008-05-20 10:28 244 --ah----- C:\sqmnoopt18.sqm 2008-05-13 11:55 . 2008-05-20 10:28 232 --ah----- C:\sqmdata18.sqm 2008-05-13 11:53 . 2008-05-20 10:26 244 --ah----- C:\sqmnoopt17.sqm 2008-05-13 11:53 . 2008-05-20 10:26 232 --ah----- C:\sqmdata17.sqm 2008-05-12 09:40 . 2008-05-20 10:25 244 --ah----- C:\sqmnoopt16.sqm 2008-05-12 09:40 . 2008-05-20 10:25 232 --ah----- C:\sqmdata16.sqm 2008-05-08 16:28 . 2008-05-19 17:05 244 --ah----- C:\sqmnoopt15.sqm 2008-05-08 16:28 . 2008-05-19 17:05 232 --ah----- C:\sqmdata15.sqm 2008-05-06 11:13 . 2008-05-19 17:01 244 --ah----- C:\sqmnoopt14.sqm 2008-05-06 11:13 . 2008-05-19 17:01 232 --ah----- C:\sqmdata14.sqm 2008-05-06 11:12 . 2008-05-19 17:00 244 --ah----- C:\sqmnoopt13.sqm 2008-05-06 11:12 . 2008-05-19 17:00 232 --ah----- C:\sqmdata13.sqm 2008-05-02 15:19 . 2008-05-19 14:20 244 --ah----- C:\sqmnoopt12.sqm 2008-05-02 15:19 . 2008-05-19 14:20 232 --ah----- C:\sqmdata12.sqm 2008-05-02 09:15 . 2008-05-19 09:23 244 --ah----- C:\sqmnoopt11.sqm 2008-05-02 09:15 . 2008-05-19 09:23 232 --ah----- C:\sqmdata11.sqm 2008-05-01 14:53 . 2008-05-19 09:17 244 --ah----- C:\sqmnoopt10.sqm 2008-05-01 14:53 . 2008-05-19 09:17 232 --ah----- C:\sqmdata10.sqm 2008-05-01 09:14 . 2008-05-16 09:14 244 --ah----- C:\sqmnoopt09.sqm 2008-05-01 09:14 . 2008-05-16 09:14 232 --ah----- C:\sqmdata09.sqm 2008-04-29 15:43 . 2008-05-15 14:16 244 --ah----- C:\sqmnoopt08.sqm 2008-04-29 15:43 . 2008-05-15 14:16 232 --ah----- C:\sqmdata08.sqm 2008-04-28 08:56 . 2008-05-15 09:38 244 --ah----- C:\sqmnoopt07.sqm 2008-04-28 08:56 . 2008-05-15 09:38 232 --ah----- C:\sqmdata07.sqm 2008-04-25 09:14 . 2008-05-14 16:22 244 --ah----- C:\sqmnoopt06.sqm 2008-04-25 09:14 . 2008-05-14 16:22 232 --ah----- C:\sqmdata06.sqm 2008-04-24 09:17 . 2008-05-14 15:58 244 --ah----- C:\sqmnoopt05.sqm 2008-04-24 09:17 . 2008-05-14 15:58 232 --ah----- C:\sqmdata05.sqm 2008-04-23 15:32 . 2008-05-14 11:41 244 --ah----- C:\sqmnoopt04.sqm 2008-04-23 15:32 . 2008-05-14 11:41 232 --ah----- C:\sqmdata04.sqm 2008-04-23 14:14 . 2008-05-14 11:41 244 --ah----- C:\sqmnoopt03.sqm 2008-04-23 14:14 . 2008-05-14 11:41 232 --ah----- C:\sqmdata03.sqm 2008-04-22 11:07 . 2008-05-14 11:41 244 --ah----- C:\sqmnoopt02.sqm 2008-04-22 11:07 . 2008-05-14 11:41 232 --ah----- C:\sqmdata02.sqm 2008-04-22 09:04 . 2008-04-22 09:04 20,608 --a------ C:\WINDOWS\system32\drivers\ngeeomiz.dat 2008-04-21 09:26 . 2008-05-14 11:41 244 --ah----- C:\sqmnoopt01.sqm 2008-04-21 09:26 . 2008-05-14 11:41 232 --ah----- C:\sqmdata01.sqm 2008-04-18 16:17 . 2008-05-20 12:55 244 --ah----- C:\sqmnoopt00.sqm 2008-04-18 16:17 . 2008-05-20 12:55 232 --ah----- C:\sqmdata00.sqm 2008-04-18 09:16 . 2008-04-18 09:16 d-------- C:\PMAIL 2008-04-17 13:04 . 2008-04-17 13:04 59,040 --a------ C:\Documents and Settings\Reception1 Admin\Application Data\GDIPFONTCACHEV1.DAT 2008-04-17 11:46 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys 2008-04-17 11:46 . 2004-08-03 23:08 25,600 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys 2008-04-17 11:46 . 2008-04-17 11:46 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-04-17 11:46 . 2008-04-17 11:46 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-04-17 11:37 . 2008-04-17 11:58 d-------- C:\Documents and Settings\Reception1 Admin\Application Data\Nokia 2008-04-17 11:36 . 2008-04-17 11:36 d-------- C:\Program Files\PC Connectivity Solution 2008-04-17 11:36 . 2008-04-17 11:36 d-------- C:\Program Files\Common Files\PCSuite 2008-04-17 11:36 . 2008-04-17 11:36 d-------- C:\Program Files\Common Files\Nokia 2008-04-17 11:36 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys 2008-04-17 11:35 . 2008-04-17 11:47 d-------- C:\Documents and Settings\Reception1 Admin\Application Data\PC Suite 2008-04-17 11:35 . 2007-11-29 10:33 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-04-17 11:35 . 2007-11-29 10:39 95,744 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-04-17 11:35 . 2007-11-29 10:39 19,328 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys 2008-04-17 11:35 . 2007-11-29 10:39 16,896 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys 2008-04-17 11:35 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys 2008-04-17 11:35 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys 2008-04-15 16:25 . 2008-04-15 16:25 d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-04-15 16:25 . 2008-04-15 16:25 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-04-14 16:14 . 2008-04-14 16:14 d-------- C:\Program Files\Trend Micro 2008-04-09 09:46 . 2008-04-09 10:11 1,467 --a------ C:\scanlog2 2008-04-08 16:40 . 2008-05-30 12:16 8,917,024 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-04-08 16:40 . 2008-05-30 12:11 120,452 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-04-08 16:28 . 2008-03-13 23:11 75,248 --a------ C:\WINDOWS\zllsputility.exe 2008-04-08 16:26 . 2008-05-30 12:12 d-------- C:\WINDOWS\system32\ZoneLabs 2008-04-08 16:26 . 2008-03-13 23:11 1,086,952 --a------ C:\WINDOWS\system32\zpeng24.dll 2008-04-08 16:25 . 2008-05-30 12:13 355,091 --a------ C:\WINDOWS\system32\vsconfig.xml 2008-04-08 12:07 . 2008-04-08 12:07 d-------- C:\kav 2008-04-04 16:25 . 2008-04-08 11:42 d-------- C:\Program Files\Sophos 2008-04-04 16:15 . 2008-04-04 16:15 d-------- C:\Documents and Settings\Reception1 Admin\Application Data\Symantec 2008-04-04 13:59 . 2008-04-04 14:14 d-------- C:\Documents and Settings\Reception1 Admin\Contacts 2008-04-04 13:03 . 2008-04-04 13:03 d-------- C:\savwsa 2008-04-04 12:16 . 2008-04-04 12:16 d-------- C:\Program Files\SonicWallES 2008-04-04 08:56 . 2008-05-30 10:58 959 --a------ C:\rollback.ini 2008-04-04 08:54 . 2008-04-17 15:40 d-------- C:\Documents and Settings\Reception1 Admin\Application Data\MailFrontier 2008-04-03 16:42 . 2008-04-17 15:40 d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier 2008-04-03 16:42 . 2008-05-13 11:25 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2008-04-03 16:41 . 2008-04-03 16:41 d-------- C:\Program Files\Zone Labs 2008-04-03 16:41 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll 2008-04-03 16:40 . 2008-05-30 12:03 d-------- C:\WINDOWS\Internet Logs 2008-04-02 15:04 . 2008-04-08 12:19 d-------- C:\Program Files\Google 2008-04-02 14:29 . 2008-04-02 14:29 d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2008-04-02 12:48 . 2008-04-02 12:48 d--h----- C:\WINDOWS\PIF 2008-04-01 15:52 . 2008-04-08 12:10 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-04-01 12:21 . 2008-04-01 12:22 722,472 --a------ C:\WINDOWS\system32\kdfmgr.oldexe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-30 09:05 --------- d-----w C:\Program Files\Folio 2008-05-30 08:57 --------- d-----w C:\Documents and Settings\Reception1 Admin\Application Data\AdobeUM 2008-05-23 15:49 2,656,256 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp 2008-05-16 06:26 2,166,272 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp 2008-05-12 10:37 --------- d-----w C:\Program Files\Northern Rock Online 2008-04-25 10:57 2,107,392 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp 2008-04-18 08:58 2,042,368 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp 2008-04-17 10:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Suite 2008-04-17 10:36 --------- d-----w C:\Program Files\Nokia 2008-04-17 10:36 --------- d-----w C:\Program Files\DIFX 2008-04-17 10:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations 2008-04-14 14:22 --------- d-----w C:\Program Files\Intermediary Mortgages 2008-04-14 14:17 --------- d-----w C:\Program Files\Alliance and Leicester Online Forms 2008-04-09 10:21 --------- d-----w C:\Program Files\Common Files\Adobe 2008-04-08 14:27 --------- d-----w C:\Program Files\CCleaner 2008-04-08 11:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\zTrend Micro 2008-04-04 15:19 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-04-04 15:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\SecTaskMan 2008-04-03 15:24 --------- d-----w C:\Program Files\NavNT 2008-04-03 15:23 --------- d-----w C:\Program Files\Symantec 2008-04-03 15:22 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Lavasoft 2008-04-02 13:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2008-04-01 14:34 --------- d-----w C:\Program Files\Enigma Software Group 2008-03-28 11:09 --------- d-----w C:\Program Files\hp LaserJet 1005 2008-03-18 15:29 60,968 ----a-w C:\Documents and Settings\Administrator\GoToAssistDownloadHelper.exe 2008-02-07 15:00 59,040 ----a-w C:\Documents and Settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT 2006-10-31 09:22 557,056 ----a-w C:\Documents and Settings\Administrator\chatlnk.exe 2005-11-28 12:39 124 ---ha-w C:\Program Files\AppUpdate.log . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{15C280AC-5C7A-41CC-841A-A21EDB6E6DA9}] 2008-05-30 12:10 86528 --a------ c:\windows\system32\d3drmh.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8C70764E-0C5F-4527-81A0-A47CAC0213A1}] 2008-03-05 11:44 98048 --a------ C:\WINDOWS\system32\d3dima.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9B0D498D-35A6-4D49-8B35-B58C8D538201}] 2008-05-30 12:10 86528 --a------ c:\windows\system32\d3drmh.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-13 23:11 919016] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 18:23:32 74308] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableCAD"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ndfioezd] d3drmh.dll 2008-05-30 12:10 86528 C:\WINDOWS\system32\d3drmh.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.MJPG"= pvmjpg21.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDA] --a------ 2005-04-07 13:32 552960 c:\program files\intranets.com\intranets desktop assistant\INDesktop.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WCOLOREAL] --a------ 2002-02-21 01:40 143360 C:\Program Files\COMPAQ\Coloreal\coloreal.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] --a------ 2006-04-03 18:12 777424 C:\Program Files\Windows Defender\MSASCui.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Internet Explorer\\iexplore.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "C:\\kav\\kis7.0\\english\\setup.exe"= R0 miniwenw;miniwenw;C:\WINDOWS\system32\drivers\miniwenw.sys [2004-08-04 13:00] R2 MSSQL$ABBEYIIOFFLINE;MSSQL$ABBEYIIOFFLINE;C:\Program Files\Abbey\Introducer Internet Offline\MSSQL$ABBEYIIOFFLINE\Binn\sqlservr.exe [2002-12-17 17:26] R2 MSSQL$LG_LP2;MSSQL$LG_LP2;C:\Program Files\Microsoft SQL Server\MSSQL$LG_LP2\Binn\sqlservr.exe [2002-12-17 18:26] R2 NMSSvc;Intel(R) NMS;C:\Windows\System32\NMSSvc.exe [2002-03-04 23:35] R3 NMSCFG;NIC Management Service Configuration Driver;C:\WINDOWS\system32\drivers\NMSCFG.SYS [2002-03-04 23:35] S0 cwmessrb;cwmessrb;C:\WINDOWS\system32\drivers\byodysng.da_ [] S2 eqmbflmh;Audio Stub Helper;C:\WINDOWS\System32\svchost.exe [2004-08-04 13:00] S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53] S3 ProcObsrv;Process creation detector.;C:\Program Files\Questionmark\QS\ProcObsrv.sys [2003-08-29 04:00] S3 SQLAgent$ABBEYIIOFFLINE;SQLAgent$ABBEYIIOFFLINE;C:\Program Files\Abbey\Introducer Internet Offline\MSSQL$ABBEYIIOFFLINE\Binn\sqlagent.EXE [2002-12-17 17:23] S3 SQLAgent$LG_LP2;SQLAgent$LG_LP2;C:\Program Files\Microsoft SQL Server\MSSQL$LG_LP2\Binn\sqlagent.EXE [2002-12-17 18:23] S3 upperdev;upperdev;C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2007-11-29 10:39] S3 UsbserFilt;UsbserFilt;C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2007-11-29 10:39] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs eqmbflmh . Contents of the 'Scheduled Tasks' folder "2008-05-30 02:00:00 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job" - C:\Program Files\AdwareAlert\AdwareAlert.ex - C:\Program Files\AdwareAlert "2008-05-30 08:10:00 C:\WINDOWS\Tasks\Download.job" - C:\Trigold\Download.exe "2008-05-30 00:31:02 C:\WINDOWS\Tasks\MP Scheduled Scan.job" - C:\Program Files\Windows Defender\MpCmdRun.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-30 12:16:30 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\cwmessrb] "ImagePath"="system32\drivers\byodysng.da_" [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\eqmbflmh] "ServiceDll"="C:\WINDOWS\system32\d3drmh.old" . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\Windows\System32\NavLogon.dll . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\MSSQL7\Binn\sqlservr.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe . ************************************************************************** . Completion time: 2008-05-30 12:22:44 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-30 11:22:29 Pre-Run: 23,895,748,608 bytes free Post-Run: 23,950,188,544 bytes free 257 --- E O F --- 2008-05-14 15:46:27