Combo Fix Log:
ComboFix 11-09-23.03 - Margaret McLeod 09/23/2011 23:32:53.4.2 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2828 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
FW: Total Protection Service *Enabled* {259FBE35-46BE-45F3-8F2F-4DB67BBBC614}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\Local Settings\Application Data\ApplicationHistory
c:\documents and settings\Administrator\Local Settings\Application Data\ApplicationHistory\CLI.EXE.c88dbd71.ini.inuse
c:\documents and settings\Administrator\Local Settings\Application Data\ApplicationHistory\EULALauncher.exe.3f62b452.ini.inuse
c:\documents and settings\Administrator\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini
c:\documents and settings\Administrator\Local Settings\Application Data\ApplicationHistory\SL30.tmp.47ef97a6.ini
c:\documents and settings\David McLeod\Local Settings\Application Data\ApplicationHistory
c:\documents and settings\David McLeod\Local Settings\Application Data\ApplicationHistory\CLI.EXE.c88dbd71.ini.inuse
c:\documents and settings\David McLeod\Local Settings\Application Data\ApplicationHistory\EULA.exe.e24c9112.ini
c:\documents and settings\David McLeod\Local Settings\Application Data\ApplicationHistory\EULALauncher.exe.3f62b452.ini
c:\documents and settings\David McLeod\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini
c:\documents and settings\David McLeod\Local Settings\Application Data\ApplicationHistory\SL30.tmp.47ef97a6.ini
c:\documents and settings\David McLeod\Local Settings\Application Data\ApplicationHistory\UninstallTB.exe.8dfaf78b.ini
c:\documents and settings\Margaret McLeod\g2mdlhlpx.exe
c:\documents and settings\Margaret McLeod\Local Settings\Application Data\ApplicationHistory
c:\documents and settings\Margaret McLeod\Local Settings\Application Data\ApplicationHistory\CLI.EXE.c88dbd71.ini.inuse
c:\documents and settings\Margaret McLeod\Local Settings\Application Data\ApplicationHistory\EULA.exe.e24c9112.ini.inuse
c:\documents and settings\Margaret McLeod\Local Settings\Application Data\ApplicationHistory\EULALauncher.exe.3f62b452.ini
c:\documents and settings\Margaret McLeod\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini
c:\documents and settings\Margaret McLeod\Local Settings\Application Data\ApplicationHistory\SL30.tmp.47ef97a6.ini
c:\documents and settings\Margaret McLeod\Local Settings\Application Data\ApplicationHistory\UninstallTB.exe.8dfaf78b.ini.inuse
c:\documents and settings\Margaret McLeod\Recent\Thumbs.db
c:\documents and settings\McAfeeMVSUser.D8V5VTG1\Local Settings\Application Data\ApplicationHistory
c:\documents and settings\McAfeeMVSUser.D8V5VTG1\Local Settings\Application Data\ApplicationHistory\CLI.EXE.c88dbd71.ini.inuse
c:\documents and settings\McAfeeMVSUser.D8V5VTG1\Local Settings\Application Data\ApplicationHistory\EULALauncher.exe.3f62b452.ini.inuse
c:\documents and settings\McAfeeMVSUser.D8V5VTG1\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini
c:\documents and settings\McAfeeMVSUser.D8V5VTG1\Local Settings\Application Data\ApplicationHistory\SL30.tmp.47ef97a6.ini
c:\documents and settings\Visitor\Local Settings\Application Data\ApplicationHistory
c:\documents and settings\Visitor\Local Settings\Application Data\ApplicationHistory\CLI.EXE.c88dbd71.ini.inuse
c:\documents and settings\Visitor\Local Settings\Application Data\ApplicationHistory\EULA.exe.e24c9112.ini
c:\documents and settings\Visitor\Local Settings\Application Data\ApplicationHistory\EULALauncher.exe.3f62b452.ini
c:\documents and settings\Visitor\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini
c:\documents and settings\Visitor\Local Settings\Application Data\ApplicationHistory\SL30.tmp.47ef97a6.ini
c:\documents and settings\Visitor\Local Settings\Application Data\ApplicationHistory\UninstallTB.exe.8dfaf78b.ini
c:\windows\bwUnin-6.1.4.68-8876480L.exe
c:\windows\system32\0.10167307505059364.exe
c:\windows\system32\0.10867668676404774.exe
c:\windows\system32\0.36686782113106053.exe
c:\windows\system32\0.42723406136819286.exe
c:\windows\system32\0.8403862509228662.exe
c:\windows\system32\0.9973202827211168.exe
c:\windows\system32\d3d9caps.dat
.
.
((((((((((((((((((((((((( Files Created from 2011-08-24 to 2011-09-24 )))))))))))))))))))))))))))))))
.
.
2011-09-24 03:02 . 2011-09-24 03:02 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\c7fEL8gTZjCkVzN
2011-09-24 03:02 . 2011-09-24 03:02 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\EdWK8fRL9TwUeIt
2011-09-24 03:02 . 2011-09-24 03:02 28752 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\MpKslb548383c.sys
2011-09-24 01:50 . 2011-09-24 01:50 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2011-09-24 01:49 . 2011-09-24 01:49 ——– d—–w- c:\windows\system32\uWK7fEL9gXjCkBz
2011-09-24 01:49 . 2011-09-24 01:49 ——– d—–w- C:\z5sWJ7fELg
2011-09-24 01:45 . 2011-09-24 01:45 28752 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\MpKsld7a54a2c.sys
2011-09-23 23:50 . 2011-09-23 23:50 28752 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\MpKsl4c7e7466.sys
2011-09-23 23:50 . 2011-09-24 03:04 56200 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\offreg.dll
2011-09-23 19:31 . 2011-09-12 23:14 7269712 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\mpengine.dll
2011-09-23 01:31 . 2011-09-23 01:31 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple Computer
2011-09-22 22:27 . 2011-09-22 22:27 ——– d-sh–w- c:\documents and settings\Administrator\IECompatCache
2011-09-22 22:20 . 2011-09-22 22:20 ——– d-sh–w- c:\documents and settings\David McLeod\IECompatCache
2011-09-22 22:17 . 2011-09-22 22:17 ——– d-sh–w- c:\documents and settings\Visitor\IECompatCache
2011-09-22 22:16 . 2011-09-22 22:16 ——– d—–w- c:\documents and settings\Visitor\Application Data\Malwarebytes
2011-09-22 21:57 . 2011-09-22 21:57 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2011-09-22 21:57 . 2011-09-22 21:57 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2011-09-22 21:39 . 2011-09-22 21:39 ——– d—–w- c:\documents and settings\David McLeod\Application Data\Malwarebytes
2011-09-22 13:45 . 2011-09-22 13:45 1324 —-a-w- c:\documents and settings\NetworkService\Local Settings\Application Data\d3d9caps.tmp
2011-09-21 20:22 . 2011-09-21 20:22 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2011-09-21 20:14 . 2011-09-23 00:18 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\Yct
2011-09-21 20:14 . 2011-09-21 20:30 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\Asmedem
2011-08-25 14:01 . 2011-09-07 00:56 ——– d—–w- c:\program files\FileZilla FTP Client
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-14 11:14 . 2011-05-16 21:17 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-12 23:14 . 2010-11-22 02:42 7269712 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-09-09 09:12 . 2004-08-11 22:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-08-31 21:00 . 2010-11-21 04:43 22216 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-08-12 02:44 . 2011-08-23 06:37 7152464 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll
2011-07-15 13:29 . 2004-08-11 22:00 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2004-08-11 22:00 10496 —-a-w- c:\windows\system32\drivers\ndistapi.sys
2009-01-01 15:01 . 2009-01-01 15:00 7518240 —-a-w- c:\program files\Firefox Setup 3.0.5.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-01-18 196608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-22 16132608]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-02-26 128296]
"EPSON Stylus Photo R200 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE" [2003-07-08 99840]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-10-08 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-01-18 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-01-18 217088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-18 148888]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-01-16 181544]
"EverioService"="c:\program files\CyberLink\PCM4Everio\EverioService.exe" [2006-11-23 151552]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-18 421160]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-03-08 273544]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\Margaret McLeod\Start Menu\Programs\Startup\
Epson printer Registration.lnk - d:\e_reg\EpsonReg.EXE [N/A]
Password Safe.lnk - c:\program files\Password Safe\pwsafe.exe [2009-12-7 2355200]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-8-10 113664]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-8-26 450560]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2007-10-18 479232]
TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2008-8-10 114688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-08-23 02:23 10536 —-a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
2008-08-26 23:55 20480 —-a-w- c:\program files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
S1 ikemqrcy;ikemqrcy;\??\c:\windows\system32\drivers\ikemqrcy.sys –> c:\windows\system32\drivers\ikemqrcy.sys [?]
S1 MpKsl4c7e7466;MpKsl4c7e7466;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\MpKsl4c7e7466.sys [9/23/2011 7:50 PM 28752]
S1 MpKsl9952cec8;MpKsl9952cec8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F7F001FF-81B8-4AB2-9F9A-D05F6A997F2F}\MpKsl9952cec8.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F7F001FF-81B8-4AB2-9F9A-D05F6A997F2F}\MpKsl9952cec8.sys [?]
S1 MpKslb548383c;MpKslb548383c;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\MpKslb548383c.sys [9/23/2011 11:02 PM 28752]
S1 MpKsld7a54a2c;MpKsld7a54a2c;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\MpKsld7a54a2c.sys [9/23/2011 9:45 PM 28752]
S2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [1/16/2009 4:31 PM 161064]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-09-12 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:34]
.
2011-09-24 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 19:39]
.
2011-09-24 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2871720974-1768929416-890385414-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-24 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2871720974-1768929416-890385414-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-24 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2871720974-1768929416-890385414-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-24 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2871720974-1768929416-890385414-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-16 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2871720974-1768929416-890385414-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-04 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2871720974-1768929416-890385414-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = localhost;*.local
Trusted Zone: intuit.com\ttlc
Trusted Zone: mcafee.com
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //FWEvent.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = [removed] [removed] [removed]
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-DZqjYCwkIrOtAuS8234A - c:\windows\System32\0.10867668676404774.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2011-09-23 23:37
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(616)
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll
.
Completion time: 2011-09-23 23:39:30
ComboFix-quarantined-files.txt 2011-09-24 03:39
ComboFix2.txt 2010-11-21 06:50
.
Pre-Run: 711,209,414,656 bytes free
Post-Run: 711,841,193,984 bytes free
.
- - End Of File - - 73E324CB206165C7D9E09E4797E2D67E
