ComboFix 08-09-03.03 - mcorcelli 2008-09-04 7:42:05.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.588 [GMT -4:00] Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat C:\Documents and Settings\mcorcelli\Application Data\macromedia\Flash Player\#SharedObjects\5ZRS9X92\bin.clearspring.com C:\Documents and Settings\mcorcelli\Application Data\macromedia\Flash Player\#SharedObjects\5ZRS9X92\bin.clearspring.com\clearspring.sol C:\Documents and Settings\mcorcelli\Application Data\macromedia\Flash Player\#SharedObjects\5ZRS9X92\interclick.com C:\Documents and Settings\mcorcelli\Application Data\macromedia\Flash Player\#SharedObjects\5ZRS9X92\interclick.com\ud.sol C:\Documents and Settings\mcorcelli\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com C:\Documents and Settings\mcorcelli\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol C:\Documents and Settings\mcorcelli\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com C:\Documents and Settings\mcorcelli\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol C:\Documents and Settings\mcorcelli\Cookies\[removed][2].txt C:\WINDOWS\setup.exe C:\WINDOWS\system32\braviax.exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML C:\WINDOWS\system32\winivstr.exe ----- BITS: Possible infected sites ----- http://server:8530 . ((((((((((((((((((((((((( Files Created from 2008-08-04 to 2008-09-04 ))))))))))))))))))))))))))))))) . 2008-09-02 11:53 . 2008-09-02 11:53 170 --a------ C:\Documents and Settings\mcorcelli\delself.bat 2008-08-19 14:11 . 2008-05-01 10:30 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll 2008-08-19 14:11 . 2008-07-07 16:32 253,952 -----c--- C:\WINDOWS\system32\dllcache\es.dll 2008-08-19 14:11 . 2008-06-24 12:23 74,240 -----c--- C:\WINDOWS\system32\dllcache\mscms.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-02 16:41 --------- d-----w C:\Program Files\Trend Micro 2008-08-26 22:03 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-08-15 13:24 --------- d-----w C:\Program Files\neovest44 2008-07-29 18:30 --------- d-----w C:\Program Files\MSECache 2008-07-24 11:52 --------- d-----w C:\Program Files\Sun 2008-07-24 11:52 --------- d-----w C:\Program Files\Java 2008-07-21 12:32 --------- d-----w C:\Documents and Settings\mcorcelli\Application Data\Webex 2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll 2007-06-20 18:36 56,912 ----a-w C:\Documents and Settings\mcorcelli\g2mdlhlpx.exe 2008-05-19 18:41 27,976 ----a-w C:\Program Files\mozilla firefox\plugins\atgpcdec.dll 2008-05-19 18:41 125,848 ----a-w C:\Program Files\mozilla firefox\plugins\atgpcext.dll 2008-05-19 18:41 46,408 ----a-w C:\Program Files\mozilla firefox\plugins\atmccli.dll 2008-05-19 18:41 98,712 ----a-w C:\Program Files\mozilla firefox\plugins\ieatgpc.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-20 68856] "AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-08-08 2321600] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-10 143360] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2008-04-16 579584] "eFax 4.3"="C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe" [2007-03-06 116224] "IRISCard 4 button manager"="C:\Program Files\IRISCard 4 Pro\bmana620.exe" [2008-02-27 1884848] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "CardScanAgent"="C:\Program Files\CardScan\CardScan\CardScanAgent.exe" [2006-10-20 176128] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-25 219136] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Desktop Manager.lnk - C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe [2006-02-24 1085534] eFax 4.3.lnk - C:\Program Files\eFax Messenger 4.3\J2GTray.exe [2007-09-20 629248] Principia Online Update.lnk - C:\Program Files\Morningstar\Principia\schedupd.exe [2007-09-06 20543] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoWelcomeScreen"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{03A80B1D-5C6A-42c2-9DFB-81B6005D8023}"= "C:\Program Files\Trend Micro\Tmas\sshook.dll" [2005-12-16 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon] 2005-05-20 21:42 73728 C:\WINDOWS\system32\VESWinlogon.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.dvsd"= C:\PROGRA~1\COMMON~1\SONYSH~1\VideoLib\sonydv.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Trend Micro Anti-Spyware.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Trend Micro Anti-Spyware.lnk backup=C:\WINDOWS\pss\Trend Micro Anti-Spyware.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0] --a------ 2007-05-10 22:46 624248 C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater] --a------ 2007-08-08 13:50 2321600 C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] --a------ 2004-11-17 23:47 118784 C:\Program Files\Apoint\Apoint.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-10 08:00 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DISCover] --a------ 2005-12-02 09:44 1064960 C:\Program Files\DISC\DISCover.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiscUpdateManager] --a------ 2005-12-02 09:43 61440 C:\Program Files\DISC\DISCUpdateMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray] --a------ 2005-08-05 17:56 64512 C:\WINDOWS\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ExecAfterFirstBoot] --a------ 2005-03-16 15:22 204800 C:\WINDOWS\SONYSYS\EFlyer\ExecAfterFirstBoot.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] --a------ 2007-01-01 17:22 3739648 C:\Program Files\Google\Google Talk\googletalk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager] --a------ 2005-11-04 17:25 159832 C:\Program Files\Common Files\AOL\1134721647\ee\AOLHostManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd] --a------ 2005-11-24 21:29 77824 C:\WINDOWS\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers] --a------ 2005-11-24 21:29 118784 C:\WINDOWS\system32\igfxpers.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray] --a------ 2005-11-24 21:29 98304 C:\WINDOWS\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISBMgr.exe] --a------ 2004-02-20 18:12 32768 C:\Program Files\Sony\ISB Utility\ISBMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2005-11-30 02:06 7335936 C:\WINDOWS\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sealmon] --a------ 2006-06-19 22:48 94208 C:\Program Files\SealedMedia\sealmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SonyPowerCfg] --a------ 2005-11-28 20:42 217088 C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2005-08-26 22:14 36975 C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2007-06-20 11:07 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Switcher.exe] --a------ 2005-11-24 15:47 167936 C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIO Recovery] --a------ 2003-04-20 00:08 28672 C:\WINDOWS\SONYSYS\VAIO Recovery\Partseal.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIO Update 2] --a------ 2005-10-12 01:36 151552 C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIOCameraUtility] --a------ 2005-12-01 06:20 69632 C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIOSurvey] --a------ 2005-06-13 19:42 258048 c:\Program Files\Sony\VAIO Survey\SurveySA.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\DISC\\DISCover.exe"= "C:\\Program Files\\DISC\\DiscStreamHub.exe"= "C:\\Program Files\\DISC\\myFTP.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Sony Pictures Games\\Wheel of Fortune\\Wheel of Fortune.exe"= "C:\\Program Files\\FutureSource\\Workstation\\winros.exe"= "C:\\Program Files\\neovest44\\qw.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe [2002-12-17 7520337] R3 SonyImgF;Sony Image Conversion Filter Driver;C:\WINDOWS\system32\DRIVERS\SonyImgF.sys [2005-11-30 28800] R3 ti21sony;ti21sony;C:\WINDOWS\system32\drivers\ti21sony.sys [2005-10-04 217472] S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;C:\Program Files\Sony\Image Converter 2\IcVzMon.exe [2005-07-14 32768] S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE [2002-12-17 311872] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] \Shell\AutoRun\command - F:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6756480e-afcf-11dc-8fa2-001302082bb0}] \Shell\AutoRun\command - F:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9ed1d0fa-5b4f-11db-8f3b-001302082bb0}] \Shell\AutoRun\command - F:\setupSNK.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f54a35bd-e37e-11db-8f6c-001302082bb0}] \Shell\AutoRun\command - F:\ntde1ect.com \Shell\explore\Command - F:\ntde1ect.com \Shell\open\Command - F:\ntde1ect.com *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 . - - - - ORPHANS REMOVED - - - - HKCU-Run-PTIM.exe - C:\Program Files\WebEx\Productivity Tools\PTIM.exe HKCU-Run-PTOneClick - C:\Program Files\WebEx\Productivity Tools\ptoneclk.exe HKCU-Run-CardScan AutoSync - (no file) . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\mcorcelli\Application Data\Mozilla\Firefox\Profiles\1tfe5f92.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-04 07:45:19 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-09-04 7:46:57 ComboFix-quarantined-files.txt 2008-09-04 11:46:46 Pre-Run: 57,847,685,120 bytes free Post-Run: 58,707,161,088 bytes free 204 --- E O F --- 2008-08-19 22:14:39