ComboFix 08-02.05.3 - MAPepin 2008-02-06 14:31:40.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1482 [GMT -5:00] Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\drivers\symavc32.sys C:\Documents and Settings\Administrator\Application Data\install.dat C:\WINDOWS\system32\Cache C:\WINDOWS\system32\drivers\BQJ56.sys C:\WINDOWS\system32\x64 . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_BQJ56 -------\LEGACY_CCEVTSVC -------\CcEvtSvc ((((((((((((((((((((((((( Files Created from 2008-01-06 to 2008-02-06 ))))))))))))))))))))))))))))))) . 2008-02-06 14:21 . 2004-08-04 05:00 260,272 -r-hs---- C:\cmldr 2008-02-06 14:03 . 2008-02-06 14:03 32 --a------ C:\WINDOWS\system32\2316743137.dat 2008-02-06 14:00 . 2008-02-06 14:00 d-------- C:\WINDOWS\ERUNT 2008-02-06 13:57 . 2008-02-06 14:06 d-------- C:\SDFix 2008-02-06 07:35 . 2008-02-06 07:35 38,400 -r-hs---- C:\WINDOWS\system32\accesswr.exe 2008-02-05 14:21 . 2008-02-05 14:21 256,000 --a------ C:\WINDOWS\system32\apiuser32.dll 2008-02-05 14:21 . 2008-02-06 14:34 0 --a------ C:\reg.reg 2008-02-05 08:33 . 2004-08-04 06:00 24,576 --a------ C:\WINDOWS\system32\userini.exe 2008-02-04 10:49 . 2008-02-06 14:03 93,184 --a------ C:\Documents and Settings\LocalService\Application Data\1001789598.exe 2008-02-04 09:38 . 2008-02-06 08:50 d-------- C:\Program Files\a-squared Anti-Malware 2008-02-04 09:18 . 2008-02-06 08:50 d-------- C:\Program Files\a-squared Free 2008-02-04 08:45 . 2008-02-04 08:45 376 --a------ C:\WINDOWS\ODBC.INI 2008-02-04 07:38 . 2008-02-06 08:53 d-------- C:\Program Files\Opera 2008-02-01 12:02 . 2006-10-26 19:58 30,512 --a------ C:\WINDOWS\system32\mdimon.dll 2008-02-01 11:58 . 2008-02-01 11:58 d-------- C:\WINDOWS\IIS Temporary Compressed Files 2008-02-01 11:58 . 2008-02-01 11:58 0 --a------ C:\WINDOWS\frontpg.ini 2008-02-01 10:56 . 2008-02-01 10:56 d-------- C:\WINDOWS\Downloaded Installations 2008-02-01 10:56 . 2003-06-25 16:05 266,360 --a------ C:\WINDOWS\system32\TweakUI.exe 2008-02-01 10:56 . 2002-06-21 15:09 160,217 --a------ C:\WINDOWS\system32\PowerToysLicense.rtf 2008-02-01 07:38 . 2008-02-01 07:38 38,400 -r-hs---- C:\WINDOWS\system32\6to4svcq.exe 2008-01-31 13:32 . 2008-01-31 13:32 17,920 --ahs---- C:\WINDOWS\system32\accessw.dll 2008-01-31 07:33 . 2008-02-04 17:12 25,984 --a------ C:\WINDOWS\system32\drivers\Ytt77.sys 2008-01-30 18:00 . 2008-01-30 18:00 29 --a------ C:\WINDOWS\system32\iepdforu.tmp 2008-01-30 17:54 . 2008-02-06 14:03 163,840 --a------ C:\Documents and Settings\LocalService\Application Data\1035870398.exe 2008-01-29 11:29 . 2008-02-06 13:03 d-------- C:\Program Files\CCleaner 2008-01-29 10:57 . 2008-02-05 10:26 8,388,671 --a------ C:\WINDOWS\pfirewall.log.old 2008-01-29 08:15 . 2008-01-29 08:15 d-------- C:\Documents and Settings\MAPepin\Application Data\DivX 2008-01-29 08:01 . 2008-01-04 16:58 120,056 --------- C:\WINDOWS\system32\pxcpyi64.exe 2008-01-29 08:01 . 2008-01-04 16:58 118,520 --------- C:\WINDOWS\system32\pxinsi64.exe 2008-01-29 08:00 . 2008-01-29 08:01 d-------- C:\Program Files\DivX 2008-01-29 07:32 . 2008-01-29 08:54 41,472 --a------ C:\WINDOWS\system32\CbEvtSvc.exe 2008-01-28 15:06 . 2008-01-28 15:06 d-------- C:\Program Files\SIW 2008-01-28 13:20 . 2008-02-05 14:29 d-------- C:\Documents and Settings\MAPepin\Application Data\OpenOffice.org2 2008-01-28 12:27 . 2008-01-28 12:27 d-------- C:\Program Files\Trend Micro 2008-01-26 15:08 . 2008-01-26 15:08 d--h----- C:\WINDOWS\system32\GroupPolicy 2008-01-26 14:20 . 2008-01-26 14:20 206 --a------ C:\WINDOWS\system32\MRT.INI 2008-01-26 13:11 . 2008-01-26 13:12 d-------- C:\WINDOWS\system32\NtmsData 2008-01-26 12:41 . 2007-08-01 22:47 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2008-01-26 11:52 . 2008-01-26 12:44 d-------- C:\Documents and Settings\MAPepin\.housecall6.6 2008-01-26 11:51 . 2008-01-26 11:51 d-------- C:\WINDOWS\Sun 2008-01-26 11:36 . 2008-01-29 08:57 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-01-25 16:08 . 2008-01-29 07:32 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-01-24 16:40 . 2008-01-29 07:52 d-------- C:\Documents and Settings\MAPepin\Application Data\XnView 2008-01-24 15:54 . 2008-01-24 15:54 21,504 --a------ C:\lo-1679164330.exe 2008-01-24 15:52 . 2008-01-24 15:52 21,504 --a------ C:\lo1289083134.exe 2008-01-24 15:52 . 2008-01-24 15:52 21,504 --a------ C:\lo-513865536.exe 2008-01-24 15:52 . 2008-01-24 15:52 21,504 --a------ C:\lo-1538082432.exe 2008-01-24 15:41 . 2008-01-24 15:41 21,504 --a------ C:\lo636569781.exe 2008-01-24 15:40 . 2008-01-24 15:40 21,504 --a------ C:\lo482396030.exe 2008-01-24 15:38 . 2008-01-24 15:38 21,504 --a------ C:\lo-22980135.exe 2008-01-22 15:28 . 2008-02-06 08:52 d-------- C:\Program Files\OpenOffice.org 2.3 2008-01-22 15:28 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-01-19 03:02 . 2006-08-21 04:14 128,896 --------- C:\WINDOWS\system32\dllcache\fltmgr.sys 2008-01-19 03:02 . 2006-08-21 04:14 23,040 --------- C:\WINDOWS\system32\dllcache\fltmc.exe 2008-01-19 03:02 . 2006-08-21 07:21 16,896 --------- C:\WINDOWS\system32\dllcache\fltlib.dll 2008-01-19 03:01 . 2008-01-19 03:01 d-------- C:\Program Files\MSXML 4.0 2008-01-18 16:43 . 2008-01-18 16:43 d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage 2008-01-18 13:43 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys 2008-01-18 09:56 . 2008-01-18 09:56 d---s---- C:\Documents and Settings\MAPepin\UserData 2008-01-18 08:51 . 2008-01-18 08:51 d-------- C:\Documents and Settings\MAPepin\Application Data\Monotype Imaging 2008-01-18 08:42 . 2008-01-18 08:42 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2008-01-18 08:33 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-01-18 08:33 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-01-18 08:33 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-01-18 07:39 . 2007-07-09 08:09 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll 2008-01-17 17:46 . 2008-01-18 09:05 d-------- C:\Documents and Settings\MAPepin\Application Data\Yahoo! 2008-01-17 17:45 . 2007-01-31 10:58 43,387 --a------ C:\WINDOWS\browser.exe 2008-01-17 17:45 . 2007-01-31 10:58 6,246 --a------ C:\WINDOWS\atty.ico 2008-01-17 17:44 . 2008-01-17 17:44 d-------- C:\WINDOWS\Motive 2008-01-17 17:44 . 2008-01-17 17:45 d-------- C:\Program Files\SBC Self Support Tool 2008-01-17 17:44 . 2008-01-17 17:44 d-------- C:\Program Files\Common Files\Motive 2008-01-17 17:44 . 2008-01-17 17:44 d-------- C:\Documents and Settings\All Users\Application Data\Motive 2008-01-17 17:44 . 2005-05-10 01:36 81,920 --------- C:\WINDOWS\system32\W32n50.dll 2008-01-17 17:44 . 2005-05-10 01:36 17,162 --------- C:\WINDOWS\system32\Pcandis5.sys 2008-01-17 17:44 . 2005-05-10 01:36 16,848 --------- C:\WINDOWS\system32\Pcandis4.sys 2008-01-17 17:44 . 2005-05-10 01:36 16,073 --------- C:\WINDOWS\system32\Pcandis3.vxd 2008-01-17 17:42 . 2008-01-17 17:42 d-------- C:\Documents and Settings\MAPepin\Application Data\ScanSoft 2008-01-17 17:33 . 2008-01-18 14:36 d-------- C:\Documents and Settings\All Users\Application Data\yahoo! 2008-01-17 17:33 . 2002-01-05 07:37 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll 2008-01-17 17:33 . 2002-01-05 06:18 84,992 --a------ C:\WINDOWS\system32\ATL70.DLL 2008-01-17 17:33 . 2001-10-11 11:26 65,536 --a------ C:\WINDOWS\system32\YCRWin32.dll 2008-01-17 17:33 . 2002-02-21 18:56 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll 2008-01-17 17:11 . 2008-01-17 17:46 d-------- C:\Program Files\Yahoo! 2008-01-17 17:07 . 2008-01-17 17:07 d-------- C:\Program Files\BroadJump 2008-01-17 16:52 . 2007-01-31 10:58 6,345 -ra------ C:\WINDOWS\system32\DevMngr.vxd 2008-01-17 16:51 . 2007-01-31 10:58 266,240 --------- C:\WINDOWS\SBCDSL.exe 2008-01-17 16:41 . 2008-01-17 16:41 d-------- C:\Documents and Settings\LocalService\Application Data\Monotype Imaging 2008-01-17 16:41 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-01-17 16:41 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys 2008-01-17 16:41 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-01-17 16:41 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys 2008-01-17 16:21 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-01-17 16:21 . 2008-01-17 16:21 4,128 --a------ C:\INFCACHE.1 2008-01-17 15:55 . 2001-08-17 13:58 19,200 --a------ C:\WINDOWS\system32\drivers\hidbatt.sys 2008-01-17 15:55 . 2001-08-17 13:58 19,200 --a------ C:\WINDOWS\system32\dllcache\hidbatt.sys 2008-01-17 15:55 . 2001-08-17 13:57 14,080 --a------ C:\WINDOWS\system32\drivers\battc.sys 2008-01-17 15:55 . 2001-08-17 13:57 14,080 --a------ C:\WINDOWS\system32\dllcache\battc.sys 2008-01-17 15:55 . 2001-08-17 13:58 9,344 --a------ C:\WINDOWS\system32\drivers\compbatt.sys 2008-01-17 15:55 . 2001-08-17 13:58 9,344 --a------ C:\WINDOWS\system32\dllcache\compbatt.sys 2008-01-17 14:42 . 2008-01-15 22:27 d-------- C:\Documents and Settings\MAPepin\Application Data\InstallShield . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-16 03:08 6,903 ----a-w C:\WINDOWS\system32\drivers\1028_Dell_OPT_755.mrk 2008-01-04 21:58 43,528 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-06-28 16:21 141848] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-06-28 16:21 162328] "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-06-28 16:21 137752] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 10:03 210472] "PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2007-03-14 12:31 30248] "IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2007-03-14 12:29 46632] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-07-26 20:03 178712] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50 221184] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 17:15 81920] "RoxioDragToDisc"="C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 10:00 1116920] "PDVDDXSrv"="C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 18:23 118784] "Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 23:46 624248] "Acrobat Speed Launch"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrobat_sl.exe" [2006-10-23 02:40 46200] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 22:33 582992] "MFPMonitor"="C:\WINDOWS\twain_32\DELL\MFP1125\Monitor\Stsmon.exe" [2007-07-22 16:10 2002944] "BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 21:26 368706] "YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 16:19 129536] "Motive SmartBridge"="C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [2005-08-24 07:51 442455] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-09-24 20:12 1036288] "ubasss"="mmdssvc.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] "ubasss"="mmdssvc.exe" [] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ SBC Self Support Tool.lnk - C:\Program Files\SBC Self Support Tool\bin\matcli.exe [2008-01-17 17:44:25 217088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "BurnWin"= {C145CF11-124F-3562-44AC-E685D962C63C} - C:\WINDOWS\system32\apiuser32.dll [2008-02-05 14:21 256000] R0 Ytt77;Ytt77;C:\WINDOWS\system32\Drivers\Ytt77.sys [2008-02-04 17:12] R1 DLARTL_M;DLARTL_M;C:\WINDOWS\system32\Drivers\DLARTL_M.SYS [2006-08-11 11:35] R2 ASFAgent;ASF Agent;C:\Program Files\Intel\ASF Agent\ASFAgent.exe [2007-01-23 04:58] R2 CbEvtSvc;CbEvtSvc;C:\WINDOWS\System32\CbEvtSvc.exe [2008-01-29 08:54] R2 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);"c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" [2007-02-10 05:29] R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-04 06:00] R2 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [2007-02-10 05:29] S2 mcmscsvcWebClient;McAfee Services mcmscsvcWebClient;C:\WINDOWS\system32\accesswr.exe srv [] S2 MSSQL$MSSMLBIZMessenger;SQL Server (MSSMLBIZ) MSSQL$MSSMLBIZMessenger;C:\WINDOWS\system32\6to4svcq.exe srv [] S2 NlaMSSQL$MSSMLBIZ;Network Location Awareness (NLA) NlaMSSQL$MSSMLBIZ;C:\WINDOWS\system32\accessw.exe srv [] S2 RDSessMgrwscsvc;Remote Desktop Help Session Manager RDSessMgrwscsvc;C:\WINDOWS\system32\activedsc.exe srv [] S2 SamSsdmserver;Security Accounts Manager SamSsdmserver;C:\WINDOWS\system32\amstreami.exe srv [] S2 SQLBrowserImapiService;SQL Server Browser SQLBrowserImapiService;C:\WINDOWS\system32\12520437r.exe srv [] S3 AsfAlrt;AsfAlrt Service;C:\WINDOWS\system32\Drivers\AsfAlrt.sys [2007-01-23 04:45] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{814033b0-c88b-11dc-b481-001aa0ea5509}] \Shell\AutoRun\command - E:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f9168a98-d3f9-11dc-b497-001aa0ea5509}] \Shell\AutoRun\command - E:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe *Newly Created Service* - CCEVTSVC *Newly Created Service* - HYW71 . Contents of the 'Scheduled Tasks' folder "2008-01-16 03:35:09 C:\WINDOWS\Tasks\McDefragTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe' "2008-01-16 03:35:08 C:\WINDOWS\Tasks\McQcTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-06 14:34:02 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\WINDOWS\system32\CcEvtSvc.exe 93184 bytes executable C:\WINDOWS\system32\drivers\Hyw71.sys 167936 bytes executable scan completed successfully hidden files: 2 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Hyw71] . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\igfxsrvc.exe C:\PROGRA~1\Yahoo!\browser\ycommon.exe C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\McAfee\MSK\MskSrver.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\WINDOWS\System32\CcEvtSvc.exe C:\WINDOWS\system32\cscript.exe . ************************************************************************** . Completion time: 2008-02-06 14:35:39 - machine was rebooted ComboFix-quarantined-files.txt 2008-02-06 19:35:35 . 2008-02-05 22:14:06 --- E O F ---