Tech Support Forum - View Single Post - XP Infected with malware ProgDav and AntiVir XP 2008 fake program

j_sollars · 08-15-2008, 05:09 PM

I had a problem with the Combofix submit and when I told IE to allow popup it lost it's connection. I do however have the combofix.txt
Should I continue without the submit to bleepingcomputer.com?

ComboFix 08-08-14.01 - bthrasher 2008-08-15 17:51:54.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.148 [GMT -5:00]
Running from: C:\Documents and Settings\bthrasher\Desktop\Combo-Fix.exe
Command switches used :: C:\Documents and Settings\bthrasher\Desktop\CFscript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\wininit.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\kicysuqa.scr
C:\Documents and Settings\All Users\Application Data\lovo.com
C:\Documents and Settings\All Users\Application Data\Symantec
C:\Documents and Settings\All Users\Application Data\Symantec\ErrLogs\{77FFBA7E-0973-4F39-BBDB-AC2F537578D2}95d3f5eb.zip
C:\Documents and Settings\All Users\Application Data\Symantec\ErrLogs\{B24E05CC-46FF-4787-BBB8-5CD516AFB118}9ea9ab05.zip
C:\Documents and Settings\All Users\Application Data\Symantec\ErrLogs\{B24E05CC-46FF-4787-BBB8-5CD516AFB118}9ea9ab05.zip.log
C:\Documents and Settings\All Users\Application Data\witicuz.scr
C:\Documents and Settings\All Users\Application Data\yhik.exe
C:\Documents and Settings\All Users\Application Data\yrovekyq.reg
C:\Documents and Settings\All Users\Application Data\yvunezas.sys
C:\Documents and Settings\bthrasher\Application Data\kuwy.com
C:\Documents and Settings\bthrasher\Application Data\okypuga.sys
C:\Documents and Settings\bthrasher\Application Data\otisunehe.reg
C:\Documents and Settings\bthrasher\Application Data\synedere.dat
C:\Program Files\Common Files\juhufema.dll
C:\Program Files\Common Files\lupynuhum.scr
C:\Program Files\Common Files\Symantec Shared
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\00100029.TKN
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll
C:\Program Files\Common Files\Symantec Shared\Support Controls\ssCmdTar.ini
C:\Program Files\Common Files\Symantec Shared\Support Controls\ssctlbr.dll
C:\Program Files\Common Files\Symantec Shared\Support Controls\ssctlln.dll
C:\Program Files\Common Files\Symantec Shared\Support Controls\ssctlwmi.dll
C:\Program Files\Common Files\Symantec Shared\Support Controls\sshelper.exe
C:\Program Files\Common Files\Symantec Shared\Support Controls\sshelper.exe.manifest
C:\Program Files\Common Files\Symantec Shared\Support Controls\SymSupCC.dll
C:\Program Files\Common Files\Symantec Shared\Support Controls\tgctlcm.dll
C:\WINDOWS\hazupexory.dat
C:\WINDOWS\otedody.sys
C:\WINDOWS\ulic.lib
C:\WINDOWS\wininit.ini

.
((((((((((((((((((((((((( Files Created from 2008-07-15 to 2008-08-15 )))))))))))))))))))))))))))))))
.

2008-08-14 07:04 . 2008-08-14 07:04 <DIR> d-------- C:\Documents and Settings\__sbs_netsetup__\Recent
2008-08-14 07:04 . 2008-08-14 07:04 <DIR> d-------- C:\Documents and Settings\__sbs_netsetup__\Cookies
2008-08-13 12:40 . 2008-05-01 09:30 331,776 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msadce.dll
2008-08-03 17:51 . 2008-08-03 17:51 <DIR> d-------- C:\Deckard
2008-08-03 17:47 . 2008-08-03 17:48 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-08-03 16:18 . 2008-08-03 16:18 <DIR> d-------- C:\Program Files\Panda Security
2008-08-03 16:18 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\pavboot.sys
2008-08-03 16:00 . 2008-08-03 16:00 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-29 19:00 . 2008-07-29 19:00 <DIR> d-------- C:\Documents and Settings\administrator.SWLAW\Application Data\Lavasoft
2008-07-29 18:52 . 2008-08-03 17:44 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-29 18:48 . 2008-07-29 18:48 <DIR> d-------- C:\Program Files\Lavasoft
2008-07-29 18:48 . 2008-07-29 18:48 164 --a------ C:\install.dat
2008-07-29 18:44 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\SYSTEM32\MSINET.OCX
2008-07-29 18:35 . 2008-07-29 18:44 <DIR> d-------- C:\Temp
2008-07-29 18:35 . 2008-07-29 18:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Prevx
2008-07-29 18:11 . 2008-07-29 18:11 <DIR> d-------- C:\WINDOWS\SYSTEM32\GroupPolicy
2008-07-29 18:11 . 2008-08-03 17:28 <DIR> d-------- C:\Program Files\Hitman Pro
2008-07-25 09:34 . 2008-08-14 13:33 <DIR> d--h----- C:\$AVG8.VAULT$
2008-07-25 08:58 . 2008-08-15 16:47 <DIR> d-------- C:\WINDOWS\SYSTEM32\DRIVERS\Avg
2008-07-25 08:58 . 2008-07-25 08:58 <DIR> d-------- C:\Program Files\AVG
2008-07-25 08:58 . 2008-07-25 08:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-07-25 08:58 . 2008-07-25 08:58 96,520 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\avgldx86.sys
2008-07-25 08:58 . 2008-07-25 08:58 10,520 --a------ C:\WINDOWS\SYSTEM32\avgrsstx.dll
2008-07-25 08:07 . 2008-07-25 08:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-25 08:03 . 2008-07-25 08:12 <DIR> d-------- C:\Documents and Settings\administrator.SWLAW\Application Data\U3
2008-07-16 12:43 . 2004-08-04 00:56 159,232 --a------ C:\WINDOWS\SYSTEM32\ptpusd.dll
2008-07-16 12:43 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\usbscan.sys
2008-07-16 12:43 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\usbscan.sys
2008-07-16 12:43 . 2001-08-17 22:36 5,632 --a------ C:\WINDOWS\SYSTEM32\ptpusb.dll
2008-07-15 15:09 . 2008-07-15 15:09 <DIR> d-------- C:\Program Files\Sun

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-14 17:49 --------- d-----w C:\Documents and Settings\bthrasher\Application Data\Wal-Mart Digital Photo Manager
2008-08-13 22:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-07-30 00:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-25 01:16 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-07-25 00:42 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-07-25 00:42 10,563 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-07-24 23:50 --------- d-----w C:\Documents and Settings\administrator.SWLAW\Application Data\Symantec
2008-07-15 20:08 --------- d-----w C:\Program Files\Java
2008-07-09 22:49 --------- d-----w C:\Documents and Settings\administrator.SWLAW\Application Data\Windows Desktop Search
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TSTimer"="C:\Program Files\Timeslips\TSTimer.exe" [2004-11-01 16:55 2382416]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-18 09:44 68856]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 13:39 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 09:04 53248]
"StatusClient 2.6"="C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe" [2004-02-27 12:29 61440]
"TomcatStartup 2.5"="C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-05-20 11:40 188416]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-01-07 14:02 49152]
"IndexTray"="C:\Program Files\Sharp\Sharpdesk\IndexTray.exe" [2004-09-14 15:53 106496]
"Indexer"="C:\Program Files\Sharp\Sharpdesk\Indexer.exe" [2004-09-14 15:54 184320]
"SharpTray"="C:\Program Files\Sharp\Sharpdesk\SharpTray.exe" [2004-09-14 16:02 32768]
"TypeRegChecker"="C:\Program Files\Sharp\Sharpdesk\TypeRegChecker.exe" [2004-09-14 15:55 57344]
"FtpServer.exe"="C:\Program Files\Sharp\Sharpdesk\FtpServer.exe" [2004-09-13 18:07 626688]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-06-17 08:31 98304]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 15:49 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 15:46 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 15:50 114688]
"WinVNC"="C:\Program Files\UltraVNC\WinVNC.exe" [2006-06-18 14:56 712704]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-25 08:58 1232152]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Windows Desktop Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 15:40:46 118784]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoDispScrSavPage"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 15:39 294400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=cru629.dat??h?5.1,avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.CEGSM"= mobilev.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-25 08:58]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-25 08:58]
R2 vnccom;vnccom;C:\WINDOWS\system32\Drivers\vnccom.SYS [2004-06-26 13:22]
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-15 17:56:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\SYSTEM32\BAsfIpM.exe
C:\WINDOWS\SYSTEM32\searchindexer.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Sharp\Sharpdesk\nsapp.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
C:\WINDOWS\SYSTEM32\searchprotocolhost.exe
C:\WINDOWS\SYSTEM32\searchfilterhost.exe
.
**************************************************************************
.
Completion time: 2008-08-15 18:01:32 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-15 23:01:21
ComboFix2.txt 2008-08-15 12:45:00

Pre-Run: 64,864,366,592 bytes free
Post-Run: 64,860,352,512 bytes free

186

08-15-2008, 05:09 PM	#9 (permalink)
j_sollars Registered User Join Date: Jul 2008 Posts: 14 OS: XP	Re: XP Infected with malware ProgDav and AntiVir XP 2008 fake program I had a problem with the Combofix submit and when I told IE to allow popup it lost it's connection. I do however have the combofix.txt Should I continue without the submit to bleepingcomputer.com? ComboFix 08-08-14.01 - bthrasher 2008-08-15 17:51:54.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.148 [GMT -5:00] Running from: C:\Documents and Settings\bthrasher\Desktop\Combo-Fix.exe Command switches used :: C:\Documents and Settings\bthrasher\Desktop\CFscript.txt * Created a new restore point FILE :: C:\WINDOWS\wininit.ini . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\kicysuqa.scr C:\Documents and Settings\All Users\Application Data\lovo.com C:\Documents and Settings\All Users\Application Data\Symantec C:\Documents and Settings\All Users\Application Data\Symantec\ErrLogs\{77FFBA7E-0973-4F39-BBDB-AC2F537578D2}95d3f5eb.zip C:\Documents and Settings\All Users\Application Data\Symantec\ErrLogs\{B24E05CC-46FF-4787-BBB8-5CD516AFB118}9ea9ab05.zip C:\Documents and Settings\All Users\Application Data\Symantec\ErrLogs\{B24E05CC-46FF-4787-BBB8-5CD516AFB118}9ea9ab05.zip.log C:\Documents and Settings\All Users\Application Data\witicuz.scr C:\Documents and Settings\All Users\Application Data\yhik.exe C:\Documents and Settings\All Users\Application Data\yrovekyq.reg C:\Documents and Settings\All Users\Application Data\yvunezas.sys C:\Documents and Settings\bthrasher\Application Data\kuwy.com C:\Documents and Settings\bthrasher\Application Data\okypuga.sys C:\Documents and Settings\bthrasher\Application Data\otisunehe.reg C:\Documents and Settings\bthrasher\Application Data\synedere.dat C:\Program Files\Common Files\juhufema.dll C:\Program Files\Common Files\lupynuhum.scr C:\Program Files\Common Files\Symantec Shared C:\Program Files\Common Files\Symantec Shared\CCPD-LC\00100029.TKN C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll C:\Program Files\Common Files\Symantec Shared\Support Controls\ssCmdTar.ini C:\Program Files\Common Files\Symantec Shared\Support Controls\ssctlbr.dll C:\Program Files\Common Files\Symantec Shared\Support Controls\ssctlln.dll C:\Program Files\Common Files\Symantec Shared\Support Controls\ssctlwmi.dll C:\Program Files\Common Files\Symantec Shared\Support Controls\sshelper.exe C:\Program Files\Common Files\Symantec Shared\Support Controls\sshelper.exe.manifest C:\Program Files\Common Files\Symantec Shared\Support Controls\SymSupCC.dll C:\Program Files\Common Files\Symantec Shared\Support Controls\tgctlcm.dll C:\WINDOWS\hazupexory.dat C:\WINDOWS\otedody.sys C:\WINDOWS\ulic.lib C:\WINDOWS\wininit.ini . ((((((((((((((((((((((((( Files Created from 2008-07-15 to 2008-08-15 ))))))))))))))))))))))))))))))) . 2008-08-14 07:04 . 2008-08-14 07:04 <DIR> d-------- C:\Documents and Settings\__sbs_netsetup__\Recent 2008-08-14 07:04 . 2008-08-14 07:04 <DIR> d-------- C:\Documents and Settings\__sbs_netsetup__\Cookies 2008-08-13 12:40 . 2008-05-01 09:30 331,776 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msadce.dll 2008-08-03 17:51 . 2008-08-03 17:51 <DIR> d-------- C:\Deckard 2008-08-03 17:47 . 2008-08-03 17:48 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-08-03 16:18 . 2008-08-03 16:18 <DIR> d-------- C:\Program Files\Panda Security 2008-08-03 16:18 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\pavboot.sys 2008-08-03 16:00 . 2008-08-03 16:00 <DIR> d-------- C:\Program Files\Trend Micro 2008-07-29 19:00 . 2008-07-29 19:00 <DIR> d-------- C:\Documents and Settings\administrator.SWLAW\Application Data\Lavasoft 2008-07-29 18:52 . 2008-08-03 17:44 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-07-29 18:48 . 2008-07-29 18:48 <DIR> d-------- C:\Program Files\Lavasoft 2008-07-29 18:48 . 2008-07-29 18:48 164 --a------ C:\install.dat 2008-07-29 18:44 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\SYSTEM32\MSINET.OCX 2008-07-29 18:35 . 2008-07-29 18:44 <DIR> d-------- C:\Temp 2008-07-29 18:35 . 2008-07-29 18:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Prevx 2008-07-29 18:11 . 2008-07-29 18:11 <DIR> d-------- C:\WINDOWS\SYSTEM32\GroupPolicy 2008-07-29 18:11 . 2008-08-03 17:28 <DIR> d-------- C:\Program Files\Hitman Pro 2008-07-25 09:34 . 2008-08-14 13:33 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-07-25 08:58 . 2008-08-15 16:47 <DIR> d-------- C:\WINDOWS\SYSTEM32\DRIVERS\Avg 2008-07-25 08:58 . 2008-07-25 08:58 <DIR> d-------- C:\Program Files\AVG 2008-07-25 08:58 . 2008-07-25 08:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8 2008-07-25 08:58 . 2008-07-25 08:58 96,520 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\avgldx86.sys 2008-07-25 08:58 . 2008-07-25 08:58 10,520 --a------ C:\WINDOWS\SYSTEM32\avgrsstx.dll 2008-07-25 08:07 . 2008-07-25 08:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-07-25 08:03 . 2008-07-25 08:12 <DIR> d-------- C:\Documents and Settings\administrator.SWLAW\Application Data\U3 2008-07-16 12:43 . 2004-08-04 00:56 159,232 --a------ C:\WINDOWS\SYSTEM32\ptpusd.dll 2008-07-16 12:43 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\usbscan.sys 2008-07-16 12:43 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\usbscan.sys 2008-07-16 12:43 . 2001-08-17 22:36 5,632 --a------ C:\WINDOWS\SYSTEM32\ptpusb.dll 2008-07-15 15:09 . 2008-07-15 15:09 <DIR> d-------- C:\Program Files\Sun . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-14 17:49 --------- d-----w C:\Documents and Settings\bthrasher\Application Data\Wal-Mart Digital Photo Manager 2008-08-13 22:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-07-30 00:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-07-25 01:16 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-07-25 00:42 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-07-25 00:42 10,563 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-07-24 23:50 --------- d-----w C:\Documents and Settings\administrator.SWLAW\Application Data\Symantec 2008-07-15 20:08 --------- d-----w C:\Program Files\Java 2008-07-09 22:49 --------- d-----w C:\Documents and Settings\administrator.SWLAW\Application Data\Windows Desktop Search 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TSTimer"="C:\Program Files\Timeslips\TSTimer.exe" [2004-11-01 16:55 2382416] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-18 09:44 68856] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 13:39 1289000] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 09:04 53248] "StatusClient 2.6"="C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe" [2004-02-27 12:29 61440] "TomcatStartup 2.5"="C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-05-20 11:40 188416] "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-01-07 14:02 49152] "IndexTray"="C:\Program Files\Sharp\Sharpdesk\IndexTray.exe" [2004-09-14 15:53 106496] "Indexer"="C:\Program Files\Sharp\Sharpdesk\Indexer.exe" [2004-09-14 15:54 184320] "SharpTray"="C:\Program Files\Sharp\Sharpdesk\SharpTray.exe" [2004-09-14 16:02 32768] "TypeRegChecker"="C:\Program Files\Sharp\Sharpdesk\TypeRegChecker.exe" [2004-09-14 15:55 57344] "FtpServer.exe"="C:\Program Files\Sharp\Sharpdesk\FtpServer.exe" [2004-09-13 18:07 626688] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-06-17 08:31 98304] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 15:49 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 15:46 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 15:50 114688] "WinVNC"="C:\Program Files\UltraVNC\WinVNC.exe" [2006-06-18 14:56 712704] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-25 08:58 1232152] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Windows Desktop Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 15:40:46 118784] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system] "NoDispScrSavPage"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoWelcomeScreen"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 15:39 294400] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=cru629.dat??h?5.1,avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "MSACM.CEGSM"= mobilev.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24] R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-25 08:58] R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-25 08:58] R2 vnccom;vnccom;C:\WINDOWS\system32\Drivers\vnccom.SYS [2004-06-26 13:22] . ************************************************************************ catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-15 17:56:50 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\SYSTEM32\BAsfIpM.exe C:\WINDOWS\SYSTEM32\searchindexer.exe C:\Program Files\AVG\AVG8\avgrsx.exe C:\Program Files\Sharp\Sharpdesk\nsapp.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe C:\WINDOWS\SYSTEM32\searchprotocolhost.exe C:\WINDOWS\SYSTEM32\searchfilterhost.exe . ************************************************************************ . Completion time: 2008-08-15 18:01:32 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-15 23:01:21 ComboFix2.txt 2008-08-15 12:45:00 Pre-Run: 64,864,366,592 bytes free Post-Run: 64,860,352,512 bytes free 186