Tech Support Forum - View Single Post - Unwanted popups and malware in the system

jmash · 11-16-2008, 05:16 AM

Hello Chemist,

I was able to run ComboFix successfuly. Then installed Java Runtime Environment (JRE) 6 Update 10 and followed the steps to delete all the cache. Then I have run ATF successfully.

But I could not run Kaspersky Online Scanner as it cannot find the newly installed version of Java on my machine and hence the Accept button (is visible) but not enabled. I tried to stop all anti virus scans as well. Hence I am posting just my ComboFix.txt log here.
Pls. let me know how I can run Kaspersky?

System feedback: The system seems to be slightly better now. Some of the dirty popups seem to have disappeared now.

ComboFix.txt
ComboFix 08-11-14.01 - cav.bal 2008-11-16 10:44:10.8 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.153 [GMT 0:00]
Running from: c:\documents and settings\cav.bal\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\cav.bal\Desktop\CFScript.txt
* Created a new restore point
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((( Files Created from 2008-10-16 to 2008-11-16 )))))))))))))))))))))))))))))))
.

2008-11-12 15:15 . 2008-11-12 21:53 <DIR> d-------- c:\program files\Visual CertExam Suite
2008-11-10 18:51 . 2008-11-10 18:51 <DIR> d-------- c:\program files\Microsoft Silverlight
2008-11-10 17:51 . 2008-11-10 17:51 21,504 --a------ c:\winnt\system32\2.8-Install.exe
2008-11-10 17:40 . 2008-11-10 17:40 <DIR> d-------- c:\documents and settings\All Users\~Backup
2008-10-26 08:42 . 2008-10-26 08:42 108,336 --a------ c:\winnt\system32\MSWINSCK.OCX
2008-10-21 10:00 . 2008-11-13 12:54 <DIR> d-------- c:\documents and settings\cav.bal\Application Data\skypePM
2008-10-21 10:00 . 2008-10-21 10:00 56 --ah----- c:\winnt\system32\ezsidmv.dat
2008-10-21 09:56 . 2008-11-13 12:55 <DIR> d-------- c:\documents and settings\cav.bal\Application Data\Skype
2008-10-21 09:55 . 2008-11-05 20:56 <DIR> d-------- c:\program files\Google
2008-10-21 09:54 . 2008-10-21 09:55 <DIR> d-------- c:\program files\Skype
2008-10-21 09:54 . 2008-10-21 09:54 <DIR> d-------- c:\program files\Common Files\Skype
2008-10-21 09:54 . 2008-10-21 09:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\Skype

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-13 12:59 --------- d-----w c:\program files\OfficeScan NT
2008-11-12 15:15 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-06 20:49 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-06 20:48 --------- d-----w c:\program files\SpywareBlaster
2008-11-05 21:03 --------- d-----w c:\program files\SpywareGuard
2008-10-06 09:04 201 ---ha-w c:\documents and settings\cav.bal\Application Data\hpothb07.dat
2008-10-06 09:03 172 ---ha-w c:\documents and settings\Anthony.D.Roberts\hpothb07.dat
2008-10-06 09:03 0 ---ha-w c:\documents and settings\All Users\hpothb07.dat
2006-02-13 16:20 32,064 ----a-w c:\documents and settings\cav.bal\Application Data\GDIPFONTCACHEV1.DAT
2005-04-26 08:48 57,344 ----a-w c:\program files\internet explorer\plugins\PluginWrapper.dll
2007-04-17 20:42 32,768 --sha-w c:\winnt\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012007041720070418\index.dat
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of c:\documents and settings\All Users\~Backup ----

((((((((((((((((((((((((((((( snapshot@2008-11-13_12.58.59.03 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-01-08 19:15:18 176,195 ----a-w c:\winnt\temp\COFFF2.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CatUserRun"="exec32" [X]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-03-27 4670968]
"ctfmon.exe"="c:\winnt\system32\ctfmon.exe" [2004-08-04 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-29 21755688]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\winnt\System32\hkcmd.exe" [2003-01-24 114688]
"RightFAX Print-to-Fax Driver"="c:\program files\RightFax\\FaxCtrl.exe" [2003-07-17 114688]
"Synchronization Manager"="c:\winnt\system32\mobsync.exe" [2004-08-04 143360]
"NeroCheck"="c:\program files\Ahead\\Nero\NeroCheck.exe" [2001-07-09 155648]
"DirXconnect settings"="c:\\PROGRA~1\Sie\DIRXDI~1\dxdSetup.exe" [2000-03-21 106561]
"OfficeScanNT Monitor"="c:\program files\OfficeScan NT\pccntmon.exe" [2007-01-08 356429]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-09-07 77824]
"Java Profiles Fix"="c:\program files\Java\Profile Fix\Java_Profile.exe" [2003-04-30 32768]
"JavaProfileFix2"="c:\program files\Java\Profile Fix\Java_Profile_2.exe" [2004-03-04 36864]
"SIECACST"="c:\program files\Sie\Card API\bin\siecacst.exe" [2005-02-01 45056]
"Discovery User Input"="c:\discovery\User Input\userin32.exe" [2005-11-10 212992]
"JavaProfileFix3"="c:\program files\Java\Profile Fix\JAVA_Fix 3.exe" [2005-12-06 53248]
"Migrator"="c:\program files\CryptoEx\Migrator\Migrator.exe" [2004-10-26 290816]
"CryptoExTrayV3"="c:\program files\CryptoEx\Common\CexTray.exe" [2005-03-01 909312]
"SchedulingAgent_nDG"="c:\program files\ManageSoft\Schedule Agent\ndschedag.exe" [2006-07-27 1183744]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 57393]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 40960]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-03-28 622592]
"SetDefPrt"="c:\program files\Brother\Brmfl06a\BrStDvPt.exe" [2005-01-26 49152]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-04-10 61440]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe" [2008-01-09 77824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\winnt\system32\Macromed\Flash\GetFlash.exe" [2003-09-04 94208]

c:\documents and settings\cav.bal\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-08-29 360448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"disablecad"= 0 (0x0)
"MaxGPOScriptWait"= 1800 (0x708)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"ConnectHomeDirToRoot"= 0 (0x0)
"HideLogonScripts"= 0 (0x0)
"EnableProfileQuota"= 1 (0x1)
"ProfileQuotaMessage"= You have exceeded your profile storage space. Before you can log off, you need to move some items from your profile to network or local storage.
"MaxProfileSize"= 10240 (0x2800)
"WarnUserTimeout"= 15 (0xf)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoPublishingWizard"= 1 (0x1)
"NoWebServices"= 1 (0x1)
"NoOnlinePrintsWizard"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoMSAppLogo5ChannelNotify"= 1 (0x1)
"NoBandCustomize"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"Btn_Back"= 0 (0x0)
"Btn_Forward"= 0 (0x0)
"Btn_Stop"= 0 (0x0)
"Btn_Refresh"= 0 (0x0)
"Btn_Home"= 0 (0x0)
"Btn_Search"= 0 (0x0)
"Btn_History"= 0 (0x0)
"Btn_Favorites"= 0 (0x0)
"Btn_Media"= 0 (0x0)
"Btn_Folders"= 0 (0x0)
"Btn_Fullscreen"= 0 (0x0)
"Btn_Tools"= 0 (0x0)
"Btn_MailNews"= 0 (0x0)
"Btn_Size"= 0 (0x0)
"Btn_Print"= 0 (0x0)
"Btn_Edit"= 0 (0x0)
"Btn_Discussions"= 0 (0x0)
"Btn_Cut"= 0 (0x0)
"Btn_Copy"= 0 (0x0)
"Btn_Paste"= 0 (0x0)
"Btn_Encoding"= 0 (0x0)
"Btn_PrintPreview"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoLogoff"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoPrinterTabs"= 0 (0x0)
"PromptRunasInstallNetPath"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"DisallowCpl"= 1 (0x1)
"NoThumbnailCache"= 1 (0x1)
"ForceStartMenuLogOff"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"GreyMSIAds"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"DisablePersonalDirChange"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)
"StartRunNoHOMEPATH"= 1 (0x1)
"EnforceShellExtensionSecurity"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"Btn_Back"= 0 (0x0)
"Btn_Forward"= 0 (0x0)
"Btn_Stop"= 0 (0x0)
"Btn_Refresh"= 0 (0x0)
"Btn_Home"= 0 (0x0)
"Btn_Search"= 0 (0x0)
"Btn_History"= 0 (0x0)
"Btn_Favorites"= 0 (0x0)
"Btn_Media"= 0 (0x0)
"Btn_Folders"= 0 (0x0)
"Btn_Fullscreen"= 0 (0x0)
"Btn_Tools"= 0 (0x0)
"Btn_MailNews"= 0 (0x0)
"Btn_Size"= 0 (0x0)
"Btn_Print"= 0 (0x0)
"Btn_Edit"= 0 (0x0)
"Btn_Discussions"= 0 (0x0)
"Btn_Cut"= 0 (0x0)
"Btn_Copy"= 0 (0x0)
"Btn_Paste"= 0 (0x0)
"Btn_Encoding"= 0 (0x0)
"Btn_PrintPreview"= 0 (0x0)
"NoActiveDesktopChanges"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoSetActiveDesktop"= 0 (0x0)
"NoLogoff"= 0 (0x0)
"NoClose"= 0 (0x0)
"NoSetFolders"= 0 (0x0)
"EnforceShellExtensionSecurity"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoPrinterTabs"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\winlogon]
"Shell"="SGPro.exe /shell"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\CexTrayWinLogon]
2005-01-26 12:25 57344 c:\program files\CryptoEx\Common\CexTrayWinLogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Shutdown\0\0]
"Script"=CBEShutdown.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Shutdown\1\0]
"Script"=bnls299acmdline.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\0]
"Script"=catstart.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\1\0]
"Script"=\\GB001.Sie.net\sysvol\GB001.Sie.net\scripts\CatPC\CAT Basic Environment\Setup\Setup.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\2\0]
"Script"=DeployCentennialAgent.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\3\0]
"Script"=bnls299acmdline.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1960408961-725345543-468838394-1152\Scripts\Logoff\0\0]
"Script"=CBELogoff.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1960408961-725345543-468838394-31563\Scripts\Logoff\0\0]
"Script"=CBELogoff.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1960408961-725345543-468838394-34625\Scripts\Logoff\0\0]
"Script"=CBELogoff.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-450047656-3918250416-1063027673-500\Scripts\Logoff\0\0]
"Script"=CBELogoff.bat

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 Achernar;Achernar - SCSI Command Filters;c:\winnt\system32\Drivers\Achernar.sys [2006-03-15 16855]
R2 CBBS;CAT Bulletin Board;c:\program files\Sie\CAT Bulletin Board\CBBS.exe [2002-06-20 65536]
R2 mgsdl;ManageSoft Peer-to-Peer Download Service;"c:\program files\ManageSoft\Launcher\mgsdl.exe" [2006-07-27 1286144]
R2 ndGlobalLauncher;ManageSoft installation agent;"c:\program files\ManageSoft\Launcher\ndserv.exe" [2006-07-27 2539520]
R2 ndinit;ManageSoft managed device;"c:\program files\ManageSoft\Schedule Agent\ndinit.exe" [2006-07-27 655360]
R2 openFT FTNEA;openFT Server;"c:\program files\openFT\bin\NEACTRLS.EXE" [2003-11-12 253952]
R2 openFT Security Server;openFT Security Server;"c:\program files\openFT\bin\SECSERV.EXE" [2003-11-12 86016]
R2 usbdisk;usbdisk;\??\c:\winnt\system32\usbdisk.sys [2003-09-02 2176]
R3 Aldebaran;Aldebaran - SCSI Command Filters;c:\winnt\system32\Drivers\Aldebaran.sys [2006-03-15 21808]
S2 CatSystemSvc;CatSystem;c:\winnt\CatPC\CATSYS\CatSystemSvc.exe [2005-06-17 439808]
S2 ipxlauncher;Ipx/ip Service;c:\window\svchost.exe []
S3 MsDtsServer;SQL Server Integration Services;"c:\program files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe" [2005-10-14 199384]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;"c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe" /service msvsmon80 [2005-09-23 2799808]

*Newly Created Service* - MACROMEDIA_LICENSING_SERVICE
*Newly Created Service* - NTRTSCAN
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-16 10:44:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

c:\winnt\explorer.exe [3444] 0x82BAEA10

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\msftesql]
"ImagePath"="\"c:\program files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe\" -s:MSSQL.2 -f:MSSQLSERVER"
.
Completion time: 2008-11-16 10:53:55
ComboFix-quarantined-files.txt 2008-11-16 10:53:42
ComboFix2.txt 2008-11-15 12:58:55
ComboFix3.txt 2008-11-13 13:30:33

Pre-Run: 5,901,152,256 bytes free
Post-Run: 5,891,358,720 bytes free

235

Thanks,
Mahesh

11-16-2008, 05:16 AM	#12 (permalink)
jmash Registered User Join Date: May 2008 Posts: 18 OS: xp SP2	Re: Unwanted popups and malware in the system Hello Chemist, I was able to run ComboFix successfuly. Then installed Java Runtime Environment (JRE) 6 Update 10 and followed the steps to delete all the cache. Then I have run ATF successfully. But I could not run Kaspersky Online Scanner as it cannot find the newly installed version of Java on my machine and hence the Accept button (is visible) but not enabled. I tried to stop all anti virus scans as well. Hence I am posting just my ComboFix.txt log here. Pls. let me know how I can run Kaspersky? System feedback: The system seems to be slightly better now. Some of the dirty popups seem to have disappeared now. ComboFix.txt ComboFix 08-11-14.01 - cav.bal 2008-11-16 10:44:10.8 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.153 [GMT 0:00] Running from: c:\documents and settings\cav.bal\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\cav.bal\Desktop\CFScript.txt * Created a new restore point . - REDUCED FUNCTIONALITY MODE - . ((((((((((((((((((((((((( Files Created from 2008-10-16 to 2008-11-16 ))))))))))))))))))))))))))))))) . 2008-11-12 15:15 . 2008-11-12 21:53 <DIR> d-------- c:\program files\Visual CertExam Suite 2008-11-10 18:51 . 2008-11-10 18:51 <DIR> d-------- c:\program files\Microsoft Silverlight 2008-11-10 17:51 . 2008-11-10 17:51 21,504 --a------ c:\winnt\system32\2.8-Install.exe 2008-11-10 17:40 . 2008-11-10 17:40 <DIR> d-------- c:\documents and settings\All Users\~Backup 2008-10-26 08:42 . 2008-10-26 08:42 108,336 --a------ c:\winnt\system32\MSWINSCK.OCX 2008-10-21 10:00 . 2008-11-13 12:54 <DIR> d-------- c:\documents and settings\cav.bal\Application Data\skypePM 2008-10-21 10:00 . 2008-10-21 10:00 56 --ah----- c:\winnt\system32\ezsidmv.dat 2008-10-21 09:56 . 2008-11-13 12:55 <DIR> d-------- c:\documents and settings\cav.bal\Application Data\Skype 2008-10-21 09:55 . 2008-11-05 20:56 <DIR> d-------- c:\program files\Google 2008-10-21 09:54 . 2008-10-21 09:55 <DIR> d-------- c:\program files\Skype 2008-10-21 09:54 . 2008-10-21 09:54 <DIR> d-------- c:\program files\Common Files\Skype 2008-10-21 09:54 . 2008-10-21 09:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\Skype . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-13 12:59 --------- d-----w c:\program files\OfficeScan NT 2008-11-12 15:15 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-06 20:49 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2008-11-06 20:48 --------- d-----w c:\program files\SpywareBlaster 2008-11-05 21:03 --------- d-----w c:\program files\SpywareGuard 2008-10-06 09:04 201 ---ha-w c:\documents and settings\cav.bal\Application Data\hpothb07.dat 2008-10-06 09:03 172 ---ha-w c:\documents and settings\Anthony.D.Roberts\hpothb07.dat 2008-10-06 09:03 0 ---ha-w c:\documents and settings\All Users\hpothb07.dat 2006-02-13 16:20 32,064 ----a-w c:\documents and settings\cav.bal\Application Data\GDIPFONTCACHEV1.DAT 2005-04-26 08:48 57,344 ----a-w c:\program files\internet explorer\plugins\PluginWrapper.dll 2007-04-17 20:42 32,768 --sha-w c:\winnt\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012007041720070418\index.dat . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- Directory of c:\documents and settings\All Users\~Backup ---- ((((((((((((((((((((((((((((( snapshot@2008-11-13_12.58.59.03 ))))))))))))))))))))))))))))))))))))))))) . + 2007-01-08 19:15:18 176,195 ----a-w c:\winnt\temp\COFFF2.EXE . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CatUserRun"="exec32" [X] "Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-03-27 4670968] "ctfmon.exe"="c:\winnt\system32\ctfmon.exe" [2004-08-04 15360] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-29 21755688] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HotKeysCmds"="c:\winnt\System32\hkcmd.exe" [2003-01-24 114688] "RightFAX Print-to-Fax Driver"="c:\program files\RightFax\\FaxCtrl.exe" [2003-07-17 114688] "Synchronization Manager"="c:\winnt\system32\mobsync.exe" [2004-08-04 143360] "NeroCheck"="c:\program files\Ahead\\Nero\NeroCheck.exe" [2001-07-09 155648] "DirXconnect settings"="c:\\PROGRA~1\Sie\DIRXDI~1\dxdSetup.exe" [2000-03-21 106561] "OfficeScanNT Monitor"="c:\program files\OfficeScan NT\pccntmon.exe" [2007-01-08 356429] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-09-07 77824] "Java Profiles Fix"="c:\program files\Java\Profile Fix\Java_Profile.exe" [2003-04-30 32768] "JavaProfileFix2"="c:\program files\Java\Profile Fix\Java_Profile_2.exe" [2004-03-04 36864] "SIECACST"="c:\program files\Sie\Card API\bin\siecacst.exe" [2005-02-01 45056] "Discovery User Input"="c:\discovery\User Input\userin32.exe" [2005-11-10 212992] "JavaProfileFix3"="c:\program files\Java\Profile Fix\JAVA_Fix 3.exe" [2005-12-06 53248] "Migrator"="c:\program files\CryptoEx\Migrator\Migrator.exe" [2004-10-26 290816] "CryptoExTrayV3"="c:\program files\CryptoEx\Common\CexTray.exe" [2005-03-01 909312] "SchedulingAgent_nDG"="c:\program files\ManageSoft\Schedule Agent\ndschedag.exe" [2006-07-27 1183744] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648] "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 57393] "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 40960] "BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-03-28 622592] "SetDefPrt"="c:\program files\Brother\Brmfl06a\BrStDvPt.exe" [2005-01-26 49152] "ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-04-10 61440] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe" [2008-01-09 77824] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "FlashPlayerUpdate"="c:\winnt\system32\Macromed\Flash\GetFlash.exe" [2003-09-04 94208] c:\documents and settings\cav.bal\Start Menu\Programs\Startup\ SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-08-29 360448] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "disablecad"= 0 (0x0) "MaxGPOScriptWait"= 1800 (0x708) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "ConnectHomeDirToRoot"= 0 (0x0) "HideLogonScripts"= 0 (0x0) "EnableProfileQuota"= 1 (0x1) "ProfileQuotaMessage"= You have exceeded your profile storage space. Before you can log off, you need to move some items from your profile to network or local storage. "MaxProfileSize"= 10240 (0x2800) "WarnUserTimeout"= 15 (0xf) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoPublishingWizard"= 1 (0x1) "NoWebServices"= 1 (0x1) "NoOnlinePrintsWizard"= 1 (0x1) "NoWelcomeScreen"= 1 (0x1) "NoMSAppLogo5ChannelNotify"= 1 (0x1) "NoBandCustomize"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "Btn_Back"= 0 (0x0) "Btn_Forward"= 0 (0x0) "Btn_Stop"= 0 (0x0) "Btn_Refresh"= 0 (0x0) "Btn_Home"= 0 (0x0) "Btn_Search"= 0 (0x0) "Btn_History"= 0 (0x0) "Btn_Favorites"= 0 (0x0) "Btn_Media"= 0 (0x0) "Btn_Folders"= 0 (0x0) "Btn_Fullscreen"= 0 (0x0) "Btn_Tools"= 0 (0x0) "Btn_MailNews"= 0 (0x0) "Btn_Size"= 0 (0x0) "Btn_Print"= 0 (0x0) "Btn_Edit"= 0 (0x0) "Btn_Discussions"= 0 (0x0) "Btn_Cut"= 0 (0x0) "Btn_Copy"= 0 (0x0) "Btn_Paste"= 0 (0x0) "Btn_Encoding"= 0 (0x0) "Btn_PrintPreview"= 0 (0x0) "NoFavoritesMenu"= 0 (0x0) "NoLogoff"= 0 (0x0) "NoDeletePrinter"= 0 (0x0) "NoAddPrinter"= 0 (0x0) "NoPrinterTabs"= 0 (0x0) "PromptRunasInstallNetPath"= 1 (0x1) "MemCheckBoxInRunDlg"= 1 (0x1) "DisallowCpl"= 1 (0x1) "NoThumbnailCache"= 1 (0x1) "ForceStartMenuLogOff"= 1 (0x1) "NoResolveSearch"= 1 (0x1) "NoResolveTrack"= 1 (0x1) "GreyMSIAds"= 1 (0x1) "NoRecentDocsNetHood"= 1 (0x1) "DisablePersonalDirChange"= 1 (0x1) "NoWelcomeScreen"= 1 (0x1) "NoAutoUpdate"= 1 (0x1) "StartRunNoHOMEPATH"= 1 (0x1) "EnforceShellExtensionSecurity"= 0 (0x0) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "Btn_Back"= 0 (0x0) "Btn_Forward"= 0 (0x0) "Btn_Stop"= 0 (0x0) "Btn_Refresh"= 0 (0x0) "Btn_Home"= 0 (0x0) "Btn_Search"= 0 (0x0) "Btn_History"= 0 (0x0) "Btn_Favorites"= 0 (0x0) "Btn_Media"= 0 (0x0) "Btn_Folders"= 0 (0x0) "Btn_Fullscreen"= 0 (0x0) "Btn_Tools"= 0 (0x0) "Btn_MailNews"= 0 (0x0) "Btn_Size"= 0 (0x0) "Btn_Print"= 0 (0x0) "Btn_Edit"= 0 (0x0) "Btn_Discussions"= 0 (0x0) "Btn_Cut"= 0 (0x0) "Btn_Copy"= 0 (0x0) "Btn_Paste"= 0 (0x0) "Btn_Encoding"= 0 (0x0) "Btn_PrintPreview"= 0 (0x0) "NoActiveDesktopChanges"= 0 (0x0) "NoFavoritesMenu"= 0 (0x0) "NoSetActiveDesktop"= 0 (0x0) "NoLogoff"= 0 (0x0) "NoClose"= 0 (0x0) "NoSetFolders"= 0 (0x0) "EnforceShellExtensionSecurity"= 0 (0x0) "NoDeletePrinter"= 0 (0x0) "NoAddPrinter"= 0 (0x0) "NoPrinterTabs"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\winlogon] "Shell"="SGPro.exe /shell" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\CexTrayWinLogon] 2005-01-26 12:25 57344 c:\program files\CryptoEx\Common\CexTrayWinLogon.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Shutdown\0\0] "Script"=CBEShutdown.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Shutdown\1\0] "Script"=bnls299acmdline.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\0] "Script"=catstart.cmd [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\1\0] "Script"=\\GB001.Sie.net\sysvol\GB001.Sie.net\scripts\CatPC\CAT Basic Environment\Setup\Setup.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\2\0] "Script"=DeployCentennialAgent.cmd [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\3\0] "Script"=bnls299acmdline.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1960408961-725345543-468838394-1152\Scripts\Logoff\0\0] "Script"=CBELogoff.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1960408961-725345543-468838394-31563\Scripts\Logoff\0\0] "Script"=CBELogoff.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1960408961-725345543-468838394-34625\Scripts\Logoff\0\0] "Script"=CBELogoff.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-450047656-3918250416-1063027673-500\Scripts\Logoff\0\0] "Script"=CBELogoff.bat [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= R0 Achernar;Achernar - SCSI Command Filters;c:\winnt\system32\Drivers\Achernar.sys [2006-03-15 16855] R2 CBBS;CAT Bulletin Board;c:\program files\Sie\CAT Bulletin Board\CBBS.exe [2002-06-20 65536] R2 mgsdl;ManageSoft Peer-to-Peer Download Service;"c:\program files\ManageSoft\Launcher\mgsdl.exe" [2006-07-27 1286144] R2 ndGlobalLauncher;ManageSoft installation agent;"c:\program files\ManageSoft\Launcher\ndserv.exe" [2006-07-27 2539520] R2 ndinit;ManageSoft managed device;"c:\program files\ManageSoft\Schedule Agent\ndinit.exe" [2006-07-27 655360] R2 openFT FTNEA;openFT Server;"c:\program files\openFT\bin\NEACTRLS.EXE" [2003-11-12 253952] R2 openFT Security Server;openFT Security Server;"c:\program files\openFT\bin\SECSERV.EXE" [2003-11-12 86016] R2 usbdisk;usbdisk;\??\c:\winnt\system32\usbdisk.sys [2003-09-02 2176] R3 Aldebaran;Aldebaran - SCSI Command Filters;c:\winnt\system32\Drivers\Aldebaran.sys [2006-03-15 21808] S2 CatSystemSvc;CatSystem;c:\winnt\CatPC\CATSYS\CatSystemSvc.exe [2005-06-17 439808] S2 ipxlauncher;Ipx/ip Service;c:\window\svchost.exe [] S3 MsDtsServer;SQL Server Integration Services;"c:\program files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe" [2005-10-14 199384] S4 msvsmon80;Visual Studio 2005 Remote Debugger;"c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe" /service msvsmon80 [2005-09-23 2799808] Newly Created Service - MACROMEDIA_LICENSING_SERVICE Newly Created Service - NTRTSCAN . ************************************************************************ catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-16 10:44:59 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... c:\winnt\explorer.exe [3444] 0x82BAEA10 scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\msftesql] "ImagePath"="\"c:\program files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe\" -s:MSSQL.2 -f:MSSQLSERVER" . Completion time: 2008-11-16 10:53:55 ComboFix-quarantined-files.txt 2008-11-16 10:53:42 ComboFix2.txt 2008-11-15 12:58:55 ComboFix3.txt 2008-11-13 13:30:33 Pre-Run: 5,901,152,256 bytes free Post-Run: 5,891,358,720 bytes free 235 Thanks, Mahesh Last edited by jmash; 11-16-2008 at 05:18 AM.