Posting Malewarebytes log and HJT log

icfxdesigns · December 6, 2008

Here is the current Comboxfix log

ComboFix 08-12-04.04 - Eric Smith 2008-12-06 0:09:37.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.290 [GMT -5:00]

Running from: c:\documents and settings\Eric Smith\Desktop\ComboFix.exe

* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_DOMAINSERVICE

-------\Legacy_FOPN

((((((((((((((((((((((((( Files Created from 2008-11-06 to 2008-12-06 )))))))))))))))))))))))))))))))

.

2008-12-03 19:04 . 2008-12-06 00:15 6,843 --a------ c:\windows\system32\Config.MPF

2008-12-03 18:51 . 2008-06-27 06:08 79,240 --a------ c:\windows\system32\drivers\mfeavfk.sys

2008-12-03 18:51 . 2008-06-27 06:08 40,488 --a------ c:\windows\system32\drivers\mfesmfk.sys

2008-12-03 18:51 . 2008-06-27 06:08 35,240 --a------ c:\windows\system32\drivers\mfebopk.sys

2008-12-03 18:50 . 2008-12-03 18:50 <DIR> d-------- c:\program files\McAfee.com

2008-12-03 18:50 . 2008-12-03 18:51 <DIR> d-------- c:\program files\Common Files\McAfee

2008-12-03 18:50 . 2008-06-02 14:55 120,136 --a------ c:\windows\system32\drivers\Mpfp.sys

2008-12-03 18:47 . 2008-06-20 05:41 34,152 --a------ c:\windows\system32\drivers\mferkdk.sys

2008-12-03 17:53 . 2008-12-03 17:53 141,824 --a------ c:\windows\aledacibisovu.dll

2008-12-03 17:41 . 2008-12-03 17:41 40,448 --a------ c:\windows\Bwobe.dll

2008-12-03 17:41 . 2008-12-03 17:55 40,448 --a------ C:\fjytg.exe

2008-12-03 17:41 . 2008-12-03 17:55 39,424 --a------ C:\bflkwx.exe

2008-12-03 17:40 . 2008-12-03 17:55 47,598 --a------ c:\windows\system32\wlgudeqkqwqbakn.exe

2008-12-03 17:25 . 2008-12-03 17:25 <DIR> d-------- c:\temp\DIV55

2008-12-03 14:30 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe

2008-12-03 14:30 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe

2008-12-03 14:30 . 2008-10-01 14:51 87,552 --a------ c:\windows\system32\VACFix.exe

2008-12-03 14:30 . 2008-11-29 17:58 82,944 --a------ c:\windows\system32\o4Patch.exe

2008-12-03 14:30 . 2008-05-18 20:40 82,944 --a------ c:\windows\system32\IEDFix.exe

2008-12-03 14:30 . 2008-11-29 17:58 82,944 --a------ c:\windows\system32\IEDFix.C.exe

2008-12-03 14:30 . 2008-08-18 11:19 82,432 --a------ c:\windows\system32\404Fix.exe

2008-12-03 14:30 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe

2008-12-03 14:30 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe

2008-12-03 14:09 . 2008-12-03 14:09 1,152 --a------ c:\windows\system32\windrv.sys

2008-12-03 14:08 . 2008-12-03 14:08 <DIR> d-------- c:\program files\Common Files\Download Manager

2008-12-02 19:19 . 2008-12-02 19:19 <DIR> d-------- c:\program files\Lavasoft

2008-12-02 19:19 . 2008-12-03 18:40 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft

2008-12-01 22:09 . 2008-12-01 22:09 <DIR> d-------- C:\rsit

2008-12-01 20:50 . 2008-12-01 21:01 250 --a------ c:\windows\gmer.ini

2008-11-29 15:27 . 2008-11-29 15:25 37,280 --a------ c:\windows\system32\drivers\btwmodem.sys

2008-11-26 00:12 . 2008-11-26 00:12 <DIR> d-------- c:\documents and settings\Eric Smith\Application Data\Malwarebytes

2008-11-26 00:12 . 2008-11-26 00:12 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2008-11-19 16:16 . 2008-11-19 16:16 <DIR> d-------- C:\MyAmerican

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-12-04 00:04 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee

2008-12-03 23:53 --------- d-----w c:\program files\McAfee

2008-11-29 20:25 879,496 ----a-w c:\windows\system32\drivers\btkrnl.sys

2008-11-29 20:25 74,656 ----a-w c:\windows\system32\drivers\btwusb.sys

2008-11-29 20:25 55,352 ----a-w c:\windows\system32\drivers\btwhid.sys

2008-11-29 20:25 539,432 ----a-w c:\windows\system32\drivers\btaudio.sys

2008-11-29 20:25 37,424 ----a-w c:\windows\system32\drivers\btport.sys

2008-11-29 20:25 156,392 ----a-w c:\windows\system32\drivers\btwdndis.sys

2008-11-28 19:29 --------- d-----w c:\program files\Trend Micro

2008-11-25 14:02 --------- d-----w c:\program files\Common Files\Blizzard Entertainment

2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys

2008-10-22 19:24 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore

2004-01-27 18:23 3,149 ----a-w c:\program files\Common Files\remove_tools.html

2003-06-03 00:08 60,928 --sha-w c:\program files\Thumbs.db

2003-03-12 20:12 151,920 ----a-w c:\documents and settings\Eric Smith\Application Data\GDIPFONTCACHEV1.DAT

2001-11-03 21:04 271 --sha-w c:\program files\desktop.ini

2001-11-03 21:04 23,357 ---ha-w c:\program files\folder.htt

1989-12-12 14:10 190,000 --sha-r c:\windows\fkmqpcb.exe

2004-11-30 22:33 620,759 --sha-w c:\windows\Config\ptflmx.bak1

2004-11-30 22:39 620,759 --sha-w c:\windows\Config\ptflmx.bak2

2002-11-05 04:43 203,504 --sha-w c:\windows\DRM\IndivBox.dll

2004-10-30 22:26 2,434,769 --sha-w c:\windows\msagent\chars\golnu.bak2

2004-11-20 12:30 59,706,025 --sha-w c:\windows\system\CatRoot\drahsm.bak1

2004-11-20 12:37 59,706,025 --sha-w c:\windows\system\CatRoot\drahsm.bak2

2007-12-04 03:44 88 --sh--r c:\windows\system32\34912FB5F2.sys

2007-12-14 18:50 56 --sh--r c:\windows\system32\F2B52F9134.sys

2007-12-14 18:50 4,184 --sha-w c:\windows\system32\KGyGaAvL.sys

2004-10-22 22:22 1,179,425 --sha-w c:\windows\Tasks\kabteni.bak2

2004-10-20 22:21 575,911 --sha-w c:\windows\Tasks\vrdsnd.bak2

.

((((((((((((((((((((((((((((( snapshot@2008-12-04_16.54.46.28 )))))))))))))))))))))))))))))))))))))))))

.

- 2008-12-04 18:10:13 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat

+ 2008-12-06 00:54:35 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat

- 2008-12-04 18:10:13 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

+ 2008-12-06 00:54:35 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

- 2008-12-04 18:10:13 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

+ 2008-12-06 00:54:35 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN]

@="{30351346-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4FCC-81B4-1E394CA267EB}]

2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN]

@="{30351347-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4FCC-81B4-1E394CA267EB}]

2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN]

@="{30351348-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4FCC-81B4-1E394CA267EB}]

2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN]

@="{3035134B-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{3035134B-7B7D-4FCC-81B4-1E394CA267EB}]

2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN]

@="{3035134C-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{3035134C-7B7D-4FCC-81B4-1E394CA267EB}]

2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN]

@="{3035134D-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{3035134D-7B7D-4FCC-81B4-1E394CA267EB}]

2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN]

@="{3035134E-7B7D-4FCC-81B4-1E394CA267EB}"

[HKEY_CLASSES_ROOT\CLSID\{3035134E-7B7D-4FCC-81B4-1E394CA267EB}]

2007-08-26 10:40 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]

"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-06-20 1207080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]

"hpbdfawep"="c:\program files\HP\Dfawep\bin\hpbdfawep.exe" [2007-04-25 954368]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]

"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-07-12 1117184]

"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2008-07-11 641208]

"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2005-09-26 169984]

"Gpatev"="c:\windows\Bwobe.dll" [2008-12-03 40448]

"Lgehuhogajim"="c:\windows\aledacibisovu.dll" [2008-12-03 141824]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-03 c:\windows\system32\bthprops.cpl]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Bluetooth Mouse.lnk - c:\program files\Bluetooth Mouse\MulMouse.exe [2008-04-21 245760]

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-09-11 576104]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.I263"= i263_32.drv

"VIDC.VDOM"= vdowave.drv

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]

backup=c:\windows\pss\Acrobat Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]

backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]

backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]

backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk

backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Trend Micro Anti-Spyware.lnk]

backup=c:\windows\pss\Trend Micro Anti-Spyware.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Xpress Mail Personal Edition.lnk]

backup=c:\windows\pss\Xpress Mail Personal Edition.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Eric Smith^Start Menu^Programs^Startup^Adobe Gamma.lnk]

backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Eric Smith^Start Menu^Programs^Startup^TA_Start.lnk]

backup=c:\windows\pss\TA_Start.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\websearch]

wjview [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

--a------ 2004-08-10 04:00 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]

--a------ 2005-05-15 01:04 332800 c:\program files\Dell Support\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]

--a------ 2005-09-08 04:20 122940 c:\windows\system32\DLA\DLACTRLW.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]

--a------ 2005-09-29 13:01 67584 c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gpatev]

--a------ 2008-12-03 17:41 40448 c:\windows\Bwobe.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]

--a------ 2006-06-20 21:36 1207080 c:\progra~1\MI3AA1~1\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]

--a------ 2005-06-17 06:56 139264 c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]

--a------ 2005-10-14 19:46 77824 c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]

--a------ 2005-10-14 19:50 114688 c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]

--a------ 2005-10-14 19:49 94208 c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

--a------ 2005-06-10 09:44 249856 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

--a------ 2005-06-10 09:44 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

--a------ 2008-09-10 16:40 289576 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lgehuhogajim]

--a------ 2008-12-03 17:53 141824 c:\windows\aledacibisovu.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]

--a------ 2005-06-08 13:44 196608 c:\program files\Logitech\Video\ManifestEngine.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]

--a------ 2005-06-08 14:24 458752 c:\program files\Logitech\Video\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]

--a------ 2005-06-08 14:14 217088 c:\program files\Logitech\Video\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]

--a------ 2005-07-19 16:32 221184 c:\windows\system32\LVCOMSX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Magentic]

--a------ 2007-05-30 13:03 475180 c:\progra~1\Magentic\bin\Magentic.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

--a------ 2002-12-05 16:24 2181704 c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE2]

--a------ 2003-05-08 11:00 49152 c:\program files\ScanSoft\OmniPageSE2.0\opwareSE2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

--a------ 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoipStunt]

--a------ 2008-02-06 20:53 8824112 c:\program files\VoipStunt.com\VoipStunt\voipstunt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Voipwise]

--a------ 2008-12-01 21:33 8944944 c:\program files\Voipwise.com\Voipwise\voipwise.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]

--a------ 2007-03-27 14:22 4670968 c:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"Ati HotKey Poller"=2 (0x2)

"Crypkey License"=2 (0x2)

"Macromedia Licensing Service"=3 (0x3)

"MDM"=2 (0x2)

"MskService"=2 (0x2)

"mcupdmgr.exe"=3 (0x3)

"McTskshd.exe"=2 (0x2)

"McDetect.exe"=2 (0x2)

"GEARSecurity"=2 (0x2)

"AOL ACS"=2 (0x2)

"Norton Ghost"=2 (0x2)

"ccPwdSvc"=3 (0x3)

"ccEvtMgr"=2 (0x2)

"Symantec Core LC"=3 (0x3)

"NetSvc"=3 (0x3)

"iPod Service"=3 (0x3)

"IAANTMon"=2 (0x2)

"DomainService"=2 (0x2)

"ccSetMgr"=2 (0x2)

"Bonjour Service"=2 (0x2)

"aawservice"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]

"AdaptecDirectCD"="c:\program files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"

"Bargains"=c:\program files\Bargain Buddy\bin2\bargains.exe

"CreateCD50"=c:\progra~1\COMMON~1\ADAPTE~1\CREATECD\CREATE~2.EXE -r

"EbatesMoeMoneyMaker"=wjview /cp:p "c:\program files\EbatesMoeMoneyMaker\System\Code" Main lp: "c:\program files\EbatesMoeMoneyMaker"

"HotKeysCmds"=c:\windows\SYSTEM32\HKCMD.EXE

"IgfxTray"=c:\windows\SYSTEM32\IGFXTRAY.EXE

"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

"LoadQM"=loadqm.exe

"MediaLoads Installer"="c:\program files\DownloadWare\dw.exe" /H

"NAV Agent"=c:\progra~1\NORTON~2\NAVAPW32.EXE

"New.net Startup"=rundll32 c:\progra~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup

"Premeter"=c:\progra~1\NETRAT~1\PREMETER\PRMT.EXE

"Promon.exe"=Promon.exe

"PromulGate"="c:\program files\DelFin\PromulGate\PgMonitr.exe"

"QuickTime Task"="c:\windows\SYSTEM32\qttask.exe" -atboottime

"webHancer Agent"="c:\program files\webHancer\Programs\whAgent.exe"

"WhenUSave"=c:\progra~1\SAVE\Save.exe

"WINSTART001.EXE"=c:\windows\SYSTEM32\WinStart001.EXE -b

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\WS_FTP Pro\\wsftppro.exe"=

"c:\\Program Files\\Trillian\\trillian.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\GlobalSCAPE\\CuteFTP\\CUTFTP32.EXE"=

"c:\\Games\\empire\\ee\\Empire Earth.exe"=

"c:\\Program Files\\Intuit\\QuickBooks 2007\\QBDBMgrN.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager

"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager

"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

"c:\\Program Files\\Xpress Mail\\Personal Edition\\XpressMailDesktopClient.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

"c:\\Program Files\\Magentic\\bin\\MgImp.exe"=

"c:\\Program Files\\Magentic\\bin\\Magentic.exe"=

"c:\\Program Files\\Magentic\\bin\\MgApp.exe"=

"c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=

"c:\\Program Files\\VoipStunt.com\\VoipStunt\\VoipStunt.exe"=

"c:\\Program Files\\Voipwise.com\\Voipwise\\Voipwise.exe"=

"c:\\Program Files\\WinSCP\\WinSCP.exe"=

"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\HP1006MC.EXE"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

"c:\\ComboFix\\fdsv.cfexe"=

"c:\\Program Files\\QuickTime\\QTTask.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\McAfee\SiteAdvisor\McSACore.exe" [2008-12-03 203280]

S1 BthEnumm;BthEnumm;c:\windows\system32\drivers\BthEnumm.sys []

S1 cdfss;cdfss;c:\windows\system32\drivers\cdfss.sys []

S2 0298821228435651mcinstcleanup;McAfee Application Installer Cleanup (0298821228435651);c:\windows\TEMP\029882~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service []

S3 LLUSBFLT;LLUSBFLT;c:\windows\system32\drivers\llusbflt.sys [2006-03-13 4736]

S3 PLUsbbc2;High-Speed USB Bridge Cable Driver;c:\windows\system32\Drivers\usbbc2.sys [2006-03-13 8960]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]

\Shell\AutoRun\command - E:\setup.exe

*Newly Created Service* - 0298821228435651MCINSTCLEANUP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]

"c:\progra~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:WIN9X /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]

"c:\progra~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:WIN9X /user /install

"c:\progra~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]

"c:\progra~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]

"c:\progra~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install

"c:\progra~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]

c:\windows\SYSTEM32\updcrl.exe -e -u c:\windows\SYSTEM\verisignpub1.crl

.

Contents of the 'Scheduled Tasks' folder

2008-12-01 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-12-03 c:\windows\Tasks\McDefragTask.job

- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 18:10]

2008-12-03 c:\windows\Tasks\McQcTask.job

- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 18:10]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.icfxdesigns.com/

mSearch Bar = hxxp://www.topfivesearch.com/sidesearch.asp

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www.yahoo.com

IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O16 -: DirectAnimation Java Classes - file://c:\windows\SYSTEM\dajava.cab

c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

c:\windows\Downloaded Program Files\ppctl.dll - O16 -: ppctlcab

hxxp://www.pestscan.com/scanner/ppctlcab.cab

c:\windows\Downloaded Program Files\OSD406.OSD

FireFox -: Profile - c:\documents and settings\Eric Smith\Application Data\Mozilla\Firefox\Profiles\zmbzzhv3.Eric\

FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FireFox -: prefs.js - STARTUP.HOMEPAGE - www.icfxdesigns.com

FF -: plugin - c:\program files\DivX\DivX Content Uploader\npUpload.dll

FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll

FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPJava11.dll

FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPJava12.dll

FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPJava13.dll

FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPJava14.dll

FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPJava32.dll

FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll

FF -: plugin - c:\program files\Java\j2re1.4.2_03\bin\NPOJI610.dll

FF -: plugin - c:\program files\Mozilla Firefox\plugins\npsnapfish.dll

FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-12-06 00:15:28

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\windows\ehome\ehrecvr.exe

c:\windows\ehome\ehSched.exe

c:\progra~1\McAfee\MSC\mcmscsvc.exe

c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe

c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe

c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe

c:\program files\McAfee\MPF\MpfSrv.exe

c:\program files\McAfee\MSK\msksrver.exe

c:\windows\system32\spool\drivers\w32x86\3\HP1006MC.EXE

c:\windows\ehome\mcrdsvc.exe

c:\windows\system32\dllhost.exe

c:\program files\TortoiseSVN\bin\TSVNCache.exe

c:\windows\system32\rundll32.exe

c:\progra~1\MI3AA1~1\rapimgr.exe

c:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE

c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe

.

**************************************************************************

.

Completion time: 2008-12-06 0:18:55 - machine was rebooted

ComboFix-quarantined-files.txt 2008-12-06 05:18:50

ComboFix2.txt 2008-12-04 21:55:51

Pre-Run: 18,968,686,592 bytes free

Post-Run: 18,960,396,288 bytes free

401 --- E O F --- 2008-11-13 08:04:50

icfxdesigns · December 6, 2008

i take it i am clean. I ran MBAM and Ad-Aware twice with no Malware infected files, and no popups.

icfx

SpySentinel · December 6, 2008

No, you are still infected

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::
c:\windows\aledacibisovu.dll
C:\fjytg.exe
C:\bflkwx.exe
c:\windows\system32\wlgudeqkqwqbakn.exe
c:\windows\fkmqpcb.exe
c:\windows\Config\ptflmx.bak1
c:\windows\Config\ptflmx.bak2
c:\windows\msagent\chars\golnu.bak2
c:\windows\system\CatRoot\drahsm.bak1
c:\windows\system\CatRoot\drahsm.bak2
c:\windows\system32\34912FB5F2.sys
c:\windows\system32\F2B52F9134.sys
c:\windows\Tasks\kabteni.bak2
c:\windows\Tasks\vrdsnd.bak2
Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lgehuhogajim"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lgehuhogajim]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"Bargains"=-
"New.net Startup"=-
"WhenUSave"=-
"webHancer Agent"=-
"Premeter"=-
"PromulGate"=-
"EbatesMoeMoneyMaker"=-
"WINSTART001.EXE"=-
Driver::
cdfss

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

icfxdesigns · December 7, 2008

Per your request, Spy! Thanks for you continued support.

-------------------------------

ComboFix 08-12-04.04 - Eric Smith 2008-12-06 19:30:38.3 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.549 [GMT -5:00]

Running from: c:\documents and settings\Eric Smith\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Eric Smith\Desktop\CFScript.txt

* Created a new restore point

* Resident AV is active

FILE ::

C:\bflkwx.exe

C:\fjytg.exe

c:\windows\aledacibisovu.dll

c:\windows\Config\ptflmx.bak1

c:\windows\Config\ptflmx.bak2

c:\windows\fkmqpcb.exe

c:\windows\msagent\chars\golnu.bak2

c:\windows\system\CatRoot\drahsm.bak1

c:\windows\system\CatRoot\drahsm.bak2

c:\windows\system32\34912FB5F2.sys

c:\windows\system32\F2B52F9134.sys

c:\windows\system32\wlgudeqkqwqbakn.exe

c:\windows\Tasks\kabteni.bak2

c:\windows\Tasks\vrdsnd.bak2

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\bflkwx.exe

C:\fjytg.exe

c:\windows\aledacibisovu.dll

c:\windows\Config\ptflmx.bak1

c:\windows\Config\ptflmx.bak2

c:\windows\fkmqpcb.exe

c:\windows\msagent\chars\golnu.bak2

c:\windows\system\CatRoot\drahsm.bak1

c:\windows\system\CatRoot\drahsm.bak2

c:\windows\system32\34912FB5F2.sys

c:\windows\system32\F2B52F9134.sys

c:\windows\system32\wlgudeqkqwqbakn.exe

c:\windows\Tasks\kabteni.bak2

c:\windows\Tasks\vrdsnd.bak2

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_DOMAINSERVICE

-------\Legacy_FOPN

-------\Service_cdfss

((((((((((((((((((((((((( Files Created from 2008-11-07 to 2008-12-07 )))))))))))))))))))))))))))))))

.

2008-12-03 19:04 . 2008-12-06 19:36 7,053 --a------ c:\windows\system32\Config.MPF