ComboFix 10-06-09.04 - Owner 06/10/2010 10:54:51.9.1 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.638.382 [GMT -4:00] Running from: c:\documents and settings\[removed]\Desktop\ComboFix.com AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\cleansweep.exe c:\cleansweep.exe\cleansweep.exe c:\cleansweep.exe\config.bin c:\docume~1\OWNER~2.PET\LOCALS~1\Temp\wrk3.tmp_33 c:\documents and settings\Owner.PETE-05CK9PEMS6\Application Data\3e4d15dd-f11a-441b-b91d-e262ed7f05f1_33.avi c:\documents and settings\Owner.PETE-05CK9PEMS6\Local Settings\temp\wrk3.tmp_33 . ((((((((((((((((((((((((( Files Created from 2010-05-10 to 2010-06-10 ))))))))))))))))))))))))))))))) . 2010-06-10 12:52 . 2010-06-10 12:51 411368 ----a-w- c:\windows\system32\deployJava1.dll 2010-06-10 12:51 . 2010-06-10 12:51 -------- d-----w- c:\program files\Java 2010-06-10 03:36 . 2010-06-10 03:36 -------- d-sh--w- c:\documents and settings\NetworkService.NT AUTHORITY.000\IETldCache 2010-06-04 21:02 . 2010-06-04 21:02 -------- d-----w- c:\windows\system32\wbem\Repository 2010-05-16 18:32 . 2010-05-16 18:32 -------- d-----w- c:\program files\iMesh Applications . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-06-10 13:02 . 2003-07-16 20:23 138496 ----a-w- c:\windows\system32\drivers\afd.sys 2010-06-10 12:52 . 2006-02-19 00:17 -------- d-----w- c:\program files\Common Files\Java 2010-06-10 12:52 . 2010-06-10 12:52 503808 ----a-w- c:\documents and settings\Owner.PETE-05CK9PEMS6\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-68707337-n\msvcp71.dll 2010-06-10 12:52 . 2010-06-10 12:52 499712 ----a-w- c:\documents and settings\Owner.PETE-05CK9PEMS6\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-68707337-n\jmc.dll 2010-06-10 12:52 . 2010-06-10 12:52 12800 ----a-w- c:\documents and settings\Owner.PETE-05CK9PEMS6\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-67bee2a2-n\decora-d3d.dll 2010-06-10 12:52 . 2010-06-10 12:52 348160 ----a-w- c:\documents and settings\Owner.PETE-05CK9PEMS6\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-68707337-n\msvcr71.dll 2010-06-10 12:52 . 2010-06-10 12:52 61440 ----a-w- c:\documents and settings\Owner.PETE-05CK9PEMS6\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-67bee2a2-n\decora-sse.dll 2010-06-09 18:47 . 2009-05-24 23:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-06-07 23:26 . 2004-06-23 21:00 -------- d-----w- c:\program files\D-link AirPlus G DWL-G120 Wireless USB 2010-05-14 12:13 . 2010-01-09 18:09 -------- d-----w- c:\program files\McAfee 2010-04-29 19:39 . 2009-05-24 23:52 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-04-29 19:39 . 2009-05-24 23:52 20952 ----a-w- c:\windows\system32\drivers\mbam.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-19 110592] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-01 524632] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040] c:\documents and settings\Owner.PETE-05CK9PEMS6\Start Menu\Programs\Startup\ SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448] c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\ D-link AirPlus G DWL-G120 Wireless USB.lnk - c:\program files\D-link AirPlus G DWL-G120 Wireless USB\120UTIL.exe [2006-1-6 241664] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJLaunchEXE] 2002-03-14 14:41 630784 ----a-w- c:\program files\Canon\BJCard\BJLaunch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] 2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] 2005-10-19 12:59 126976 ----a-w- c:\windows\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] 2005-10-19 12:59 155648 ----a-w- c:\windows\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility] 2003-11-26 17:50 19968 ------w- c:\windows\LOGI_MWX.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot] 2006-01-19 16:06 11776 ----a-w- c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray] 2006-01-19 16:06 110592 ----a-w- c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] 2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [5/21/2009 7:07 AM 64160] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 3:06 PM 1029456] --- Other Services/Drivers In Memory --- *NewlyCreated* - KLMDB *Deregistered* - klmdb . Contents of the 'Scheduled Tasks' folder 2010-06-10 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 12:07] 2010-05-15 c:\windows\Tasks\McDefragTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2010-01-09 17:22] 2010-06-01 c:\windows\Tasks\McQcTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2010-01-09 17:22] 2010-06-10 c:\windows\Tasks\User_Feed_Synchronization-{96E858C2-BB80-4CA6-A945-5D7F401AA939}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 08:31] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ FF - ProfilePath - c:\documents and settings\Owner.PETE-05CK9PEMS6\Application Data\Mozilla\Firefox\Profiles\qjys52r7.default\ . - - - - ORPHANS REMOVED - - - - HKCU-Run-3e4d15dd-f11a-441b-b91d-e262ed7f05f1_33 - c:\documents and settings\Owner.PETE-05CK9PEMS6\Application Data\3e4d15dd-f11a-441b-b91d-e262ed7f05f1_33.avi SafeBoot-klmdb.sys ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-06-10 11:03 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2010-06-10 11:09:49 ComboFix-quarantined-files.txt 2010-06-10 15:09 ComboFix2.txt 2010-06-09 18:40 ComboFix3.txt 2010-06-09 12:45 Pre-Run: 28,623,831,040 bytes free Post-Run: 28,816,158,720 bytes free - - End Of File - - 2FCDC297D7A2A8F49645FDF57D731501