ComboFix Log
ComboFix 09-11-08.03 - engsupp 2009/11/09 17:13.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.2.1033.18.1015.518 [GMT -5:00]
Running from: d:\documents and settings\engsupp\Desktop\ComFx.exe
AV: Symantec Endpoint Protection *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\Install.txt
c:\windows\msi.exe
c:\windows\system32\3538477.exe
c:\windows\system32\41.exe
c:\windows\system32\6518824.exe
c:\windows\system32\9.tmp
c:\windows\system32\959905.exe
c:\windows\system32\9968988.exe
c:\windows\system32\certstore.dat
c:\windows\system32\clrviddc.dll
c:\windows\system32\FInstall.sys
c:\windows\system32\Install.txt
c:\windows\system32\tmp.reg
d:\documents and settings\engsupp\Start Menu\Programs\Security Tool.lnk
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_6TO4
-------\Service_6to4
-------\Service_npf
((((((((((((((((((((((((( Files Created from 2009-10-09 to 2009-11-09 )))))))))))))))))))))))))))))))
.
2009-11-09 19:56 . 2009-11-09 19:56 -------- d-----w- d:\documents and settings\engsupp\Application Data\DivX
2009-11-03 16:09 . 2009-11-03 16:09 -------- d-----w- d:\documents and settings\pst246e\Application Data\DivX
2009-11-03 16:06 . 2009-11-03 16:06 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-11-03 16:06 . 2009-11-03 16:08 -------- d-----w- c:\program files\DivX
2009-11-03 15:49 . 1998-04-30 19:56 129024 ----a-w- c:\windows\UNWISE.EXE
2009-11-03 13:09 . 2004-08-04 00:56 25600 ----a-w- d:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-11-03 02:17 . 2009-11-03 02:17 -------- d-----w- c:\program files\Windows Media Connect 2
2009-11-03 02:12 . 2009-11-03 02:14 -------- d-----w- c:\windows\system32\drivers\UMDF
2009-11-03 02:01 . 2009-11-03 02:01 -------- d-----w- d:\documents and settings\pst246e\Application Data\Apple Computer
2009-11-02 18:37 . 2009-11-02 18:40 117760 ----a-w- d:\documents and settings\pst246e\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-10-28 13:07 . 2009-10-28 13:07 -------- d-----w- d:\documents and settings\engsupp\Application Data\AVG8
2009-10-27 05:34 . 2009-10-28 12:23 -------- d-sh--w- d:\documents and settings\pst246e\Application Data\lowsec
2009-10-26 01:47 . 2009-10-26 01:47 134 ----a-w- C:\wy33c108.bat
2009-10-25 20:44 . 2009-10-25 20:44 -------- d-----w- d:\documents and settings\pst246e\Application Data\SUPERAntiSpyware.com
2009-10-25 19:16 . 2009-10-31 19:57 950272 ----a-w- d:\documents and settings\pst246e\Application Data\DealAssistant\dealassistant.exe
2009-10-25 19:16 . 2009-11-01 05:25 269312 ----a-w- d:\documents and settings\pst246e\Application Data\DealAssistant\DAUninstall.exe
2009-10-25 19:16 . 2009-11-08 16:50 -------- d-----w- d:\documents and settings\pst246e\Application Data\DealAssistant
2009-10-25 19:12 . 2009-10-25 19:18 -------- d-sh--w- d:\documents and settings\pst246e\Application Data\Windows System Defender
2009-10-25 19:12 . 2009-10-25 19:12 -------- d-sh--w- d:\documents and settings\All Users\Application Data\WSDDSys
2009-10-11 20:29 . 2009-07-23 16:04 38056 ----a-w- c:\windows\system32\drivers\WGX.SYS
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-09 16:21 . 2009-03-13 11:38 -------- d-----w- d:\documents and settings\All Users\Application Data\Google Updater
2009-11-08 01:28 . 2009-01-15 15:58 -------- d-----w- d:\documents and settings\All Users\Application Data\vulScan
2009-11-06 14:31 . 2009-01-19 14:37 -------- d-----w- c:\program files\pdf995
2009-11-02 17:21 . 1980-01-01 00:00 12800 ----a-w- c:\windows\system32\winver.exe
2009-11-01 05:20 . 2009-07-23 16:09 196608 -c--a-w- d:\documents and settings\All Users\Application Data\Symantec\Cached Installs\{3BAB4914-9CC1-4CC2-A3DA-56EF62DFD373}\program files\Symantec\SEP\XDelta\xdelta3.exe
2009-11-01 05:15 . 2008-08-25 16:53 44032 ----a-w- c:\windows\system32\wbem\scrcons.exe
2009-11-01 05:15 . 2008-08-25 16:53 24064 ----a-w- c:\windows\system32\wbem\unsecapp.exe
2009-11-01 05:14 . 2008-08-25 16:53 23552 ----a-w- c:\windows\system32\wbem\mofcomp.exe
2009-11-01 05:13 . 2008-08-25 16:53 366080 ----a-w- c:\windows\system32\wbem\wmic.exe
2009-11-01 05:12 . 2008-08-25 16:53 203776 ----a-w- c:\windows\system32\wbem\wmiadap.exe
2009-11-01 05:12 . 2008-08-25 16:53 20480 ----a-w- c:\windows\system32\wbem\winmgmt.exe
2009-11-01 05:12 . 2008-08-25 16:53 123392 ----a-w- c:\windows\system32\wbem\wbemtest.exe
2009-11-01 04:51 . 2008-08-25 16:55 157696 ----a-w- c:\windows\pchealth\UploadLB\Binaries\UploadM.exe
2009-11-01 04:49 . 2008-08-25 16:55 42496 ----a-w- c:\windows\pchealth\helpctr\binaries\notiflag.exe
2009-11-01 04:47 . 2008-08-25 16:55 26112 ----a-w- c:\windows\pchealth\helpctr\binaries\HscUpd.exe
2009-11-01 04:47 . 2008-08-25 16:55 751104 ----a-w- c:\windows\pchealth\helpctr\binaries\HelpSvc.exe
2009-11-01 04:46 . 2008-08-25 16:55 107008 ----a-w- c:\windows\pchealth\helpctr\binaries\HelpHost.exe
2009-10-31 20:33 . 1980-01-01 00:00 37888 ----a-w- c:\windows\system32\xcopy.exe
2009-10-31 20:33 . 1980-01-01 00:00 39424 ----a-w- c:\windows\system32\wupdmgr.exe
2009-10-31 20:33 . 1980-01-01 00:00 20992 ----a-w- c:\windows\system32\wscntfy.exe
2009-10-31 20:33 . 2008-08-25 16:54 12800 ----a-w- c:\windows\system32\write.exe
2009-10-31 20:33 . 1980-01-01 00:00 39424 ----a-w- c:\windows\system32\wpnpinst.exe
2009-10-31 20:33 . 1980-01-01 00:00 39424 ----a-w- c:\windows\system32\wpabaln.exe
2009-10-31 20:32 . 2006-10-26 18:45 300544 ----a-w- c:\windows\system32\WISPTIS.EXE
2009-10-31 20:32 . 1980-01-01 00:00 18944 ----a-w- c:\windows\system32\winmsd.exe
2009-10-31 20:32 . 1980-01-01 00:00 15360 ----a-w- c:\windows\system32\winhlp32.exe
2009-10-31 20:32 . 1980-01-01 00:00 72704 ----a-w- c:\windows\system32\wextract.exe
2009-10-31 20:32 . 1980-01-01 00:00 56832 ----a-w- c:\windows\system32\w32tm.exe
2009-10-31 20:32 . 1980-01-01 00:00 40960 ----a-w- c:\windows\system32\vssadmin.exe
2009-10-31 20:32 . 1980-01-01 00:00 105472 ----a-w- c:\windows\system32\verifier.exe
2009-10-31 20:30 . 1980-01-01 00:00 19456 ----a-w- c:\windows\system32\tcmsetup.exe
2009-10-31 20:29 . 1980-01-01 00:00 27136 ----a-w- c:\windows\system32\ssbezier.scr
2009-10-31 20:28 . 2008-08-25 16:53 23040 ----a-w- c:\windows\system32\rwinsta.exe
2009-10-31 20:27 . 1980-01-01 00:00 18432 ----a-w- c:\windows\system32\rasdial.exe
2009-10-31 20:26 . 2002-08-29 13:00 93696 ----a-w- c:\windows\system32\opeia.exe
2009-10-31 20:26 . 1980-01-01 00:00 74752 ----a-w- c:\windows\system32\openfiles.exe
2009-10-31 20:26 . 1980-01-01 00:00 73728 ----a-w- c:\windows\system32\odbcconf.exe
2009-10-31 20:26 . 1980-01-01 00:00 133632 ----a-w- c:\windows\system32\nwscript.exe
2009-10-31 20:26 . 1980-01-01 00:00 83968 ----a-w- c:\windows\system32\nslookup.exe
2009-10-31 20:26 . 1980-01-01 00:00 44032 ----a-w- c:\windows\system32\netstat.exe
2009-10-31 20:26 . 1980-01-01 00:00 93184 ----a-w- c:\windows\system32\netsh.exe
2009-10-31 20:26 . 1980-01-01 00:00 338944 ----a-w- c:\windows\system32\netsetup.exe
2009-10-31 20:25 . 1980-01-01 00:00 118272 ----a-w- c:\windows\system32\netdde.exe
2009-10-31 20:25 . 1980-01-01 00:00 11264 ----a-w- c:\windows\system32\nddeapir.exe
2009-10-31 20:25 . 1980-01-01 00:00 27648 ----a-w- c:\windows\system32\nbtstat.exe
2009-10-31 20:25 . 2008-08-25 16:55 19456 ----a-w- c:\windows\system32\mstinit.exe
2009-10-31 20:25 . 1980-01-01 00:00 13824 ----a-w- c:\windows\system32\msswchx.exe
2009-10-31 20:24 . 2008-08-25 16:53 28160 ----a-w- c:\windows\system32\msg.exe
2009-10-31 20:24 . 1980-01-01 00:00 19968 ----a-w- c:\windows\system32\mrinfo.exe
2009-10-31 20:24 . 1980-01-01 00:00 124416 ----a-w- c:\windows\system32\mqtgsvc.exe
2009-10-31 20:24 . 1980-01-01 00:00 11776 ----a-w- c:\windows\system32\mqsvc.exe
2009-10-31 20:24 . 1980-01-01 00:00 27136 ----a-w- c:\windows\system32\mqbkup.exe
2009-10-31 20:24 . 2008-08-25 16:53 130560 ----a-w- c:\windows\system32\mplay32.exe
2009-10-31 20:24 . 1980-01-01 00:00 15360 ----a-w- c:\windows\system32\mountvol.exe
2009-10-31 20:24 . 1980-01-01 00:00 822272 ----a-w- c:\windows\system32\mmc.exe
2009-10-31 20:23 . 1980-01-01 00:00 58880 ----a-w- c:\windows\system32\migpwd.exe
2009-10-31 20:23 . 1980-01-01 00:00 92672 ----a-w- c:\windows\system32\makecab.exe
2009-10-31 20:23 . 1980-01-01 00:00 15360 ----a-w- c:\windows\system32\lpr.exe
2009-10-31 20:23 . 1980-01-01 00:00 13312 ----a-w- c:\windows\system32\lpq.exe
2009-10-31 20:23 . 2008-08-25 16:53 22528 ----a-w- c:\windows\system32\logoff.exe
2009-10-31 20:23 . 1980-01-01 00:00 66560 ----a-w- c:\windows\system32\logman.exe
2009-10-31 20:23 . 1980-01-01 00:00 12288 ----a-w- c:\windows\system32\lodctr.exe
2009-10-31 20:23 . 1980-01-01 00:00 32256 ----a-w- c:\windows\system32\lnkstub.exe
2009-10-31 20:23 . 1980-01-01 00:00 36864 ----a-w- c:\windows\system32\lights.exe
2009-10-31 20:23 . 1980-01-01 00:00 16896 ----a-w- c:\windows\system32\label.exe
2009-10-31 20:23 . 2008-08-25 17:50 42496 ----a-w- c:\windows\system32\kill.exe
2009-10-31 20:21 . 1980-01-01 00:00 62464 ----a-w- c:\windows\system32\getmac.exe
2009-10-31 20:20 . 1980-01-01 00:00 84992 ----a-w- c:\windows\system32\eventtriggers.exe
2009-10-31 20:20 . 1980-01-01 00:00 57344 ----a-w- c:\windows\system32\eventcreate.exe
2009-10-31 20:20 . 1980-01-01 00:00 200192 ----a-w- c:\windows\system32\eudcedit.exe
2009-10-31 20:20 . 1980-01-01 00:00 46592 ----a-w- c:\windows\system32\esentutl.exe
2009-10-31 20:20 . 1980-01-01 00:00 1302528 ----a-w- c:\windows\system32\dxdiag.exe
2009-10-31 20:20 . 1980-01-01 00:00 25088 ----a-w- c:\windows\system32\dvdupgrd.exe
2009-10-31 20:20 . 1980-01-01 00:00 65536 ----a-w- c:\windows\system32\driverquery.exe
2009-10-31 20:18 . 1980-01-01 00:00 102400 ----a-w- c:\windows\system32\cscript.exe
2009-10-31 20:17 . 2008-08-25 16:53 121856 ----a-w- c:\windows\system32\calc.exe
2009-10-31 20:16 . 1998-10-29 21:45 313856 ----a-w- c:\windows\IsUninst.exe
2009-10-31 20:16 . 2009-10-11 15:57 753664 ----a-w- c:\windows\diskperfm.exe
2009-10-31 20:15 . 1980-01-01 00:00 521728 ----a-w- c:\windows\system32\logonui.exe
2009-10-31 20:13 . 2008-08-25 16:53 69632 ----a-w- c:\windows\system32\rdpclip.exe
2009-10-31 20:11 . 1980-01-01 00:00 15360 ----a-w- c:\windows\system32\control.exe
2009-10-31 20:09 . 1980-01-01 00:00 25600 ----a-w- c:\windows\system32\secedit.exe
2009-10-31 20:05 . 1980-01-01 00:00 290816 ----a-w- c:\windows\winhlp32.exe
2009-10-31 20:03 . 2009-01-15 15:57 32768 ----a-w- c:\windows\system32\msgsys.exe
2009-10-31 20:02 . 2009-01-15 15:57 65536 ----a-w- c:\windows\system32\LDCmd32.EXE
2009-10-31 20:02 . 1980-01-01 00:00 52736 ----a-w- c:\windows\system32\drwtsn32.exe
2009-10-31 20:02 . 1980-01-01 00:00 227840 ----a-w- c:\windows\system32\logon.scr
2009-10-31 20:02 . 2009-01-15 15:57 31744 ----a-w- c:\windows\system32\poweroff.exe
2009-10-31 20:01 . 2008-08-25 16:55 165376 ----a-w- c:\windows\pchealth\helpctr\binaries\msconfig.exe
2009-10-31 19:58 . 2008-08-25 16:55 775680 ----a-w- c:\windows\pchealth\helpctr\binaries\HelpCtr.exe
2009-10-31 19:57 . 1980-01-01 00:00 184320 ----a-w- c:\windows\system32\dwwin.exe
2009-10-31 19:55 . 1980-01-01 00:00 102400 ----a-w- c:\windows\system32\igfxext.exe
2009-10-31 19:55 . 1980-01-01 00:00 139776 ----a-w- c:\windows\system32\rsvp.exe
2009-10-31 19:55 . 2008-08-25 16:53 133632 ----a-w- c:\windows\system32\wbem\wmiapsrv.exe
2009-10-31 19:55 . 1980-01-01 00:00 296960 ----a-w- c:\windows\system32\vssvc.exe
2009-10-31 19:55 . 1980-01-01 00:00 17920 ----a-w- c:\windows\hh.exe
2009-10-31 19:55 . 2008-08-25 16:53 13312 ----a-w- c:\windows\system32\msdtc.exe
2009-10-31 19:54 . 1980-01-01 00:00 17920 ----a-w- c:\windows\system32\dumprep.exe
2009-10-31 19:54 . 1980-01-01 00:00 36864 ----a-w- c:\windows\system32\odbcad32.exe
2009-10-31 19:54 . 1980-01-01 00:00 71168 ----a-w- c:\windows\system32\cleanmgr.exe
.
------- Sigcheck -------
[-] 2009-11-02 . 3626739051265D92503FDD04B3A230E7 . 65024 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB896423$\spoolsv.exe
[-] 2009-11-02 . 65D667C3F6EE8528BBC37984AAFB00BC . 65024 . . [5.1.2600.2696] . . c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2009-10-31 . E0AB6C4E80EF88609D88EA46015EB466 . 65024 . . [5.1.2600.2696] . . c:\windows\system32\dllcache\spoolsv.exe
[-] 2009-10-31 . E8A393B0029D7AD37B70E63BF7EDDB14 . 65024 . . [5.1.2600.2696] . . c:\windows\system32\spoolsv.exe
[-] 2009-10-31 . 5543887AB1607D3E31C963B770C793FC . 31744 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\userinit.exe
[-] 2009-10-31 . E555879FD99273B69B74C4845E67CF4F . 31744 . . [5.1.2600.2180] . . c:\windows\system32\userinit.exe
[-] 2009-10-31 . A5AB4E0D92B640F14C232F11379AD5E5 . 1039360 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\explorer.exe
[-] 2009-10-31 . AA1041E4E7895CAD0A4E4B4523D51A7C . 1039360 . . [6.00.2900.2180] . . c:\windows\explorer.exe
[-] 2009-10-31 . 44644A9C13A0D16A7E41E6C8D3DC58C6 . 20992 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\wscntfy.exe
[-] 2009-10-31 . BE5562DF6EEE39F141235F9244B5E9B6 . 20992 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe
[-] 2009-10-31 . 49586A524D109DA25B25528949645EEF . 22528 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ctfmon.exe
[-] 2009-10-31 . 8EAA66157258FC92E6DFC19DABA436E3 . 22528 . . [5.1.2600.2180] . . c:\windows\system32\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="d:\documents and settings\engsupp\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-06-30 133104]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2009-10-31 159744]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2009-10-31 98304]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2009-10-31 81920]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2009-10-31 118784]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2009-10-31 57344]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-27 136600]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-12-03 115560]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-10-31 421888]
"Logitech Utility"="LOGI_MWX.EXE" - c:\windows\LOGI_MWX.EXE [2009-10-31 28160]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2009-10-31 22528]
d:\documents and settings\All Users\Start Menu\Programs\Startup\
AutoCAD LT Startup Accelerator.lnk - c:\program files\Common Files\Autodesk Shared\acstart16.exe [2005-3-5 10872]
Cisco Systems VPN Client.lnk - c:\program files\Cisco Systems\VPN client\vpngui.exe [2009-1-15 1421328]
Printkey2000.lnk - c:\windows\Installer\{7E6CB159-AE11-4B11-960C-4DC6D48ACEE2}\Icon7E6CB159.exe [2008-8-25 13312]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoStrCmpLogical"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\apps\Super Anti Spyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\apps\Super Anti Spyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AllAlertsDisabled"=dword:00000001
"TermService"=dword:00000001
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\cba\\pds.exe"=
"c:\\WINDOWS\\system32\\msgsys.exe"=
"c:\\Program Files\\LANDesk\\LDClient\\issuser.exe"=
"c:\\Program Files\\LANDesk\\LDClient\\tmcsvc.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"= c:\\PROGRA~1\\MI3AA1~1\\wcescomm.exe
"c:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"= c:\\PROGRA~1\\MI3AA1~1\\WCESMgr.exe
"c:\\Program Files\\LANDesk\\Shared Files\\residentagent.exe"=
R1 SASDIFSV;SASDIFSV;c:\apps\Super Anti Spyware\sasdifsv.sys [2009/01/15 4:17 PM 8944]
R1 SASKUTIL;SASKUTIL;c:\apps\Super Anti Spyware\SASKUTIL.SYS [2009/01/15 4:17 PM 55024]
R2 CBA8;LANDesk(R) Management Agent;c:\program files\LANDesk\Shared Files\residentAgent.exe [2009/03/23 9:03 AM 159744]
R2 LANDesk Policy Invoker;LANDesk Policy Invoker;c:\program files\LANDesk\LDClient\policy.client.invoker.exe [2009/01/15 10:57 AM 143360]
R2 Lotus Notes Diagnostics;Lotus Notes Diagnostics;c:\lotus\notes\nsd.exe -svcinvoke -ini "c:\lotus\notes\notes.ini" --> c:\lotus\notes\nsd.exe -svcinvoke -ini c:\lotus\notes\notes.ini [?]
R2 Softmon;LANDesk(R) Software Monitoring Service;c:\program files\LANDesk\LDClient\softmon.exe [2009/01/15 10:57 AM 339968]
R2 WWLOGSVC;Wonderware Logger;c:\program files\Wonderware\Avantis\Common\wwlogsvc.exe [2009/06/05 2:31 PM 40960]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009/09/10 9:39 AM 102448]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2009/01/15 2:45 PM 80384]
R3 ldblank;Screen Blanking driver for Remote Control;c:\windows\system32\drivers\ldblank.sys [2009/01/15 10:57 AM 11904]
R3 ldmirror;ldmirror;c:\windows\system32\drivers\ldmirror.sys [2009/01/15 10:57 AM 3328]
R3 mirrorflt;Mirror Filter Driver for Uninstall;c:\windows\system32\drivers\mirrorflt.sys [2009/01/15 10:57 AM 3712]
S2 BtwSrv;BtwSrv;c:\windows\system32\svchost.exe -k netsvcs [1979/12/31 7:00 PM 14336]
S2 fastnetsrv;fastnetsrv Service;c:\windows\system32\FastNetSrv.exe --> c:\windows\system32\FastNetSrv.exe [?]
S2 gupdate1c9a3d0e831d5f8;Google Update Service (gupdate1c9a3d0e831d5f8);c:\program files\Google\Update\GoogleUpdate.exe [2009/03/13 6:43 AM 133104]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008/12/03 9:28 AM 23888]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [2009/01/25 8:56 PM 40832]
S3 OracleOraHome81ClientCache;OracleOraHome81ClientCache;c:\oracle\Ora81\bin\ONRSD.EXE [2008/08/25 1:05 PM 242328]
S3 SASENUM;SASENUM;c:\apps\Super Anti Spyware\SASENUM.SYS [2009/01/15 4:17 PM 7408]
S3 Smcinst;Symantec Auto-upgrade Agent;c:\program files\Symantec\Symantec Endpoint Protection\SmcLU\Setup\smcinst.exe --> c:\program files\Symantec\Symantec Endpoint Protection\SmcLU\Setup\smcinst.exe [?]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - MBR
*Deregistered* - mbr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
BtwSrv
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{XP_UserTweak}]
c:\windows\system32\XP_Current_User_RunOnce.vbs
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\QuickLaunch]
Regedit.exe /S c:\windows\System32\QuickLaunch.reg
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\RealPlayer Enterprise]
regedit.exe /s "c:\program files\Real\RealPlayer Enterprise\RealPlayerConfig\MimeType.reg"
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2800A44D-B9CA-4359-9CD5-45BA9469065B}]
c:\windows\msagent\agentdpv.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3282CE82-00B9-4E3A-9BFC-749CCF539395}]
msiexec /fup {3282CE82-00B9-4E3A-9BFC-749CCF539395} /qn
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6815FCDD-401D-481E-BA88-31B4754C2B46}]
msiexec /fup {6815FCDD-401D-481E-BA88-31B4754C2B46} /qn
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E8EA10C6-3C01-4411-B6BF-B1FC294D9EF8}]
msiexec /fup {E8EA10C6-3C01-4411-B6BF-B1FC294D9EF8} /qn
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EEBF9CA6-567B-41cd-B5F6-EF2C7FEF37B5}]
rundll32.exe advpack.dll,LaunchINFSectionEx c:\windows\INF\wmactedp.inf,PerUserStub,,4
.
Contents of the 'Scheduled Tasks' folder
2009-11-09 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-13 23:31]
2009-11-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-13 11:42]
2009-11-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-13 11:42]
2009-11-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-345979002-2643468011-2963444719-1009Core.job
- d:\documents and settings\engsupp\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-14 00:43]
2009-11-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-345979002-2643468011-2963444719-1009UA.job
- d:\documents and settings\engsupp\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-14 00:43]
2009-11-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-445146387-157309287-390072313-13104Core.job
- d:\documents and settings\pst246e\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-14 00:43]
2009-11-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-445146387-157309287-390072313-13104UA.job
- d:\documents and settings\pst246e\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-14 00:43]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.psc.uss.com/USS/index.asp
uInternet Connection Wizard,ShellNext = hxxp://www.psc.uss.com/USS/index.asp
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: thrust
Trusted Zone: timber
Trusted Zone: toffee
Trusted Zone: toggle
Trusted Zone: tootle
Trusted Zone: topple
Trusted Zone: torque
Trusted Zone: torrid
Trusted Zone: touchy
Trusted Zone: tousle
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
HKCU-Run-P2kAutostart - d:\documents and settings\pst246e\Desktop\Razr\P2kCommander-V5.1.0-MR\P2kAutostart.exe
SafeBoot-Symantec Antvirus
AddRemove-Recovery Toolbox for Outlook_is1 - d:\documents and settings\pst246e\Desktop\Recovery Toolbox for Outlook\unins000.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-11-09 17:53
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,79,00,73,00,\
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
@DACL=(02 0000)
"Installed"="1"
@=""
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
@DACL=(02 0000)
"NoChange"="1"
"Installed"="1"
@=""
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
@DACL=(02 0000)
"Installed"="1"
@=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1256)
c:\apps\Super Anti Spyware\SASWINLO.dll
- - - - - - - > 'explorer.exe'(3148)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Microsoft Office\OFFICE11\msohev.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Symantec\Symantec Endpoint Protection\Smc.exe
c:\program files\Common Files\Symantec Shared\ccSvcHst.exe
c:\windows\System32\bcmwltry.exe
c:\windows\System32\SCardSvr.exe
c:\program files\Cisco Systems\VPN client\cvpnd.exe
c:\program files\LANDesk\LDClient\LocalSch.EXE
c:\progra~1\LANDesk\LDClient\collector.exe
c:\windows\system32\CBA\pds.exe
c:\progra~1\LANDesk\LDClient\LDregwatch.exe
c:\program files\LANDesk\LDClient\tmcsvc.exe
c:\progra~1\LANDesk\LDClient\issuser.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\lotus\notes\nsd.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Dell\QuickSet\NICCONFIGSVC.exe
c:\program files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
c:\windows\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe
c:\windows\system32\CCM\CcmExec.exe
c:\progra~1\LANDesk\LDClient\rcgui.exe
c:\program files\Symantec\Symantec Endpoint Protection\SmcGui.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Apoint\Apntex.exe
c:\program files\PrintKey2000\Printkey2000.exe
c:\program files\Symantec\Symantec Endpoint Protection\SescLU.exe
c:\program files\Symantec\LiveUpdate\luall.exe
c:\progra~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
.
**************************************************************************
.
Completion time: 2009-11-09 18:01 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-09 23:01
Pre-Run: 10,412,916,736 bytes free
Post-Run: 10,280,230,912 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - 543AFE9B16A61166B1EED8B174B77795
Internet & Network Support 
Celebrating 12 Years! (
Author
