[Closed]Irs.gov

Oops! forgot to paste it in. Well, here's both the combofix file and the hjt file
ComboFix 07-07-27.6 - "Steve" 07/27/2007 10:02:56.1 [GMT -6:00] - NTFS
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.True


((((((((((((((((((((((((( Files Created from 2007-06-27 to 2007-07-27 )))))))))))))))))))))))))))))))


2007-07-27 10:02 16,384 –a—-t- D:\WINNT\system32\Perflib_Perfdata_3bc.dat
2007-07-27 09:58 16,384 –a—-t- D:\WINNT\system32\Perflib_Perfdata_670.dat
2007-07-23 07:53 16,384 –a—-t- D:\WINNT\system32\Perflib_Perfdata_65c.dat
2007-07-04 00:42 d——– D:\WINNT\winsxs
2007-07-04 00:41 d——– D:\Program Files\MSECache
2007-07-03 23:27 51,200 –a—— D:\WINNT\nircmd.exe
2007-07-03 09:51 d——– D:\TEMP\ZB
2007-06-30 11:58 10,438 –a—— D:\dnsbak.reg
2007-06-20 10:36 69,632 –a—— D:\WINNT\system32\JSMUXMON.DLL
2007-06-20 10:36 59,604 –a—— D:\WINNT\system32\drivers\JSFAX.SYS
2007-06-20 10:36 56,672 –a—— D:\WINNT\system32\drivers\JSSCAN.SYS
2007-06-20 10:36 50,352 –a—— D:\WINNT\system32\drivers\JSDBG.SYS
2007-06-20 10:36 35,360 –a—— D:\WINNT\system32\JETRES16.DLL
2007-06-20 10:36 327,680 –a—— D:\WINNT\system32\JETRES32.DLL
2007-06-20 10:36 23,176 –a—— D:\WINNT\system32\JSUSD.DLL
2007-06-20 10:36 173,880 –a—— D:\WINNT\system32\drivers\JSMUX.SYS
2007-06-20 09:43 107,008 –a—— D:\WINNT\system32\HOTRES32.DLL
2007-06-20 08:16 36,864 -ra—— D:\WINNT\system32\RunSetup.dll
2007-06-19 19:38 d——– D:\WINNT\system32\SoftwareDistribution
2007-06-12 11:35 88,396 -ra—— D:\WINNT\system32\JF_JBIG.DLL
2007-06-12 11:35 149,680 -ra—— D:\WINNT\system32\HP3150PS.DLL
2007-06-08 08:37 d——– D:\tweek
2007-06-07 17:11 d——– D:\TEMP


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

12/20/02 11:54a 8352936 ——— D:\Program Files\RealOnePlayerV2GOLD.exe
12/03/02 11:47a 2598120 ——— D:\Program Files\Install_AIM.exe
11/23/06 08:51a 17515272 –a—— D:\Program Files\avg75free_430a848.exe
11/16/02 12:31p 768392 ——— D:\Program Files\Easy_CD__Installer.Exe
10/23/06 11:37a 6469352 –a—— D:\Program Files\avgas-setup-7.5.0.50.exe
10/20/06 08:28a 2566736 –a—— D:\Program Files\spywareblastersetup351.exe
09/07/04 09:39p 675 –a—— D:\WINNT\Profiles\Steve.000\APPLIC~1\tvmcwrd.dll
09/07/04 09:39p 2078 –a—— D:\WINNT\Profiles\Steve.000\APPLIC~1\tvmuknwrd.dll
07/27/07 09:58a ——— d——– D:\WINNT\Profiles\Steve.000\APPLIC~1\.purple
07/24/07 09:44a ——— d——– D:\WINNT\Profiles\Steve.000\APPLIC~1\gtk-2.0
07/11/07 09:52p 1636 –a—— D:\WINNT\system32\d3d9caps.dat
07/10/07 04:36p ——— d——– D:\WINNT\Profiles\Steve.000\APPLIC~1\ZoomBrowser EX
07/06/04 05:54p 170395 –a—— D:\WINNT\Profiles\Steve.000\APPLIC~1\tvmknwrd.dll
06/23/07 11:02p ——— d——– D:\Program Files\Google
06/20/07 10:36a ——— d-a—— D:\Program Files\Common Files\efax
05/21/02 04:09p 271 —h—– D:\Program Files\desktop.ini
05/21/02 04:09p 21952 —h—– D:\Program Files\folder.htt


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoxioDragToDisc"="D:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [12/09/03 07:24p]
"RoxioEngineUtility"="D:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [05/01/03 07:44p]
"projselector"="D:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" [12/09/03 07:37p]
"OneTouch Monitor"="D:\PROGRA~1\VISION~1\ONETOU~2.EXE" [10/16/01 08:08a]
"Adobe Photo Downloader"="D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [06/06/05 11:46p]
"Synchronization Manager"="mobsync.exe" [06/19/03 01:05p D:\WINNT\system32\mobsync.exe]
"AVG7_CC"="D:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [04/17/07 09:24a]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [10/25/06 07:58p]
"Picasa Media Detector"="D:\Program Files\Picasa2\PicasaMediaDetector.exe" [12/11/06 06:36p]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [10/30/06 10:36a]
"OM_Monitor"="D:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [05/16/06 06:50p]
"Tweak UI"="TWEAKUI.CPL" [06/18/00 02:03p D:\WINNT\system32\TWEAKUI.CPL]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" [11/15/04 07:48p]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OM_Monitor"="D:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" [05/16/06 06:51p]
"BitTorrent"="D:\Program Files\BitTorrent\bittorrent.exe" [11/29/06 09:50p]
"swg"="D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [07/15/07 06:50a]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{A213B520-C6C2-11d0-AF9D-008029E1027E}"= D:\Program Files\Symantec\WinFax\WfxSeh32.Dll [07/27/98 06:54a 38400]
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= c:\Program Files\InterMute\SpySubtract\sshook.dll [10/23/06 05:44p 77824]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, msnsspc.dll, digest.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXSUPMON]
D:\WINNT\system32\LXSUPMON.EXE RUN

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPWebCap]
D:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"D:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Synchronization Manager]
mobsync.exe /logon

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFaxAppPortStarter]
wfxsnt40.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" -atboottime

R1 Avg7RsNT;AVG7 Resident Driver NT;D:\WINNT\system32\Drivers\avg7rsnt.sys
R1 Cdr4_2K;Cdr4_2K;D:\WINNT\system32\drivers\Cdr4_2K.sys
R1 Cdralw2k;Cdralw2k;D:\WINNT\system32\drivers\Cdralw2k.sys
R1 cdrbsdrv;cdrbsdrv;D:\WINNT\system32\drivers\cdrbsdrv.sys
R1 cdudf;cdudf;D:\WINNT\system32\drivers\cdudf.sys
R1 jsmux;jsmux;D:\WINNT\system32\drivers\jsmux.sys
R1 jsscan;jsscan;D:\WINNT\system32\drivers\jsscan.sys
R1 PCLEPCI;PCLEPCI;\??\D:\WINNT\system32\drivers\pclepci.sys
R1 pwd_2k;pwd_2k;D:\WINNT\system32\drivers\pwd_2k.sys
R1 UdfReadr;UdfReadr;D:\WINNT\system32\drivers\UdfReadr.sys
R2 jsfax;jsfax;D:\WINNT\system32\drivers\jsfax.sys
R2 Nbf;NetBEUI Protocol;D:\WINNT\system32\DRIVERS\nbf.sys
R3 ASAPIW2k;ASAPIW2K;D:\WINNT\system32\drivers\ASAPIW2k.sys
R3 i81x;i81x;D:\WINNT\system32\DRIVERS\i81xnt5.sys
R3 MarvinBus;Pinnacle Marvin Bus;D:\WINNT\system32\DRIVERS\MarvinBus.sys
R3 mmc_2K;mmc_2K;D:\WINNT\system32\drivers\mmc_2K.sys
R3 ngrpci;NETGEAR FA310TX Fast Ethernet Adapter Driver;D:\WINNT\system32\DRIVERS\ngrpci.sys
R3 usbprint;Microsoft USB PRINTER Class;D:\WINNT\system32\DRIVERS\usbprint.sys
S1 i81xnt4;i81xnt4;D:\WINNT\system32\DRIVERS\i81xnt4.sys
S1 sglfb;sglfb;D:\WINNT\system32\drivers\sglfb.sys
S2 Cdralwnt;Cdralwnt;D:\WINNT\system32\drivers\Cdralwnt.sys
S2 Scsiprnt;Scsiprnt;D:\WINNT\system32\drivers\Scsiprnt.sys
S3 dvd_2K;dvd_2K;D:\WINNT\system32\drivers\dvd_2K.sys
S3 grmnusb;grmnusb;D:\WINNT\system32\drivers\grmnusb.sys
S3 MPE;BDA MPE Filter;D:\WINNT\system32\DRIVERS\MPE.sys
S3 MSDV;Microsoft DV Camera and VCR;D:\WINNT\system32\DRIVERS\msdv.sys
S3 pmxscan;Visioneer USB Kernel;D:\WINNT\system32\DRIVERS\usbscan.sys
S3 ROOTMODEM;Microsoft Legacy Modem Driver;D:\WINNT\system32\Drivers\RootMdm.sys
S3 TPPFX;USB Storage Adapter FX (TPP);D:\WINNT\system32\DRIVERS\TPPFX.SYS
S3 USB20L;Linksys USB 2.0 10/100 Adapter;D:\WINNT\system32\DRIVERS\USB200M.sys
S3 VisorUsb;Handspring USB;D:\WINNT\system32\DRIVERS\VisorUsb.sys
S4 ensqio;ensqio;D:\WINNT\system32\DRIVERS\ensqio.sys
S4 jsdbg;jsdbg;D:\WINNT\system32\drivers\jsdbg.sys
S4 wfxsvc;WinFax PRO;D:\WINNT\System32\WFXSVC.EXE


Contents of the 'Scheduled Tasks' folder
2007-07-21 04:00:06 D:\WINNT\tasks\Daily Backup.job
2007-07-26 20:49:05 D:\WINNT\tasks\Daily2.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-27 10:05:17
Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes …

scanning hidden registry entries …

source file error: D:\WINNT\Profiles\STEVE~~1\ntuser.dat
scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 07/27/2007 10:07:00
D:\ComboFix-quarantined-files.txt … 07/27/07 10:06a

— E O F —
Logfile of HijackThis v1.99.1
Scan saved at 12:04, on 7/27/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP1 (5.00.2920.0000)

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\LEXBCES.EXE
D:\WINNT\system32\spoolsv.exe
D:\WINNT\system32\LEXPPS.EXE
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
D:\WINNT\system32\bgsvcgen.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\WINNT\System32\svchost.exe
c:\jetsuite\jsdaemon.exe
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\MSTask.exe
D:\WINNT\system32\stisvc.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\WINNT\system32\mspmspsv.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\Explorer.EXE
D:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
D:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe
D:\PROGRA~1\VISION~1\ONETOU~2.EXE
D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
D:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\Picasa2\PicasaMediaDetector.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\jetsuite\JETSTAT.EXE
D:\Program Files\Common Files\efax\dllcmd32.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
D:\Program Files\Handspring\HOTSYNC.EXE
D:\Program Files\iPod\bin\iPodService.exe
D:\WINNT\system32\wuauclt.exe
D:\WINNT\System32\svchost.exe
c:\jetsuite\JSFMAN.EXE
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigmtn.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [RoxioDragToDisc] "D:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "D:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [projselector] "D:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" -r
O4 - HKLM\..\Run: [OneTouch Monitor] D:\PROGRA~1\VISION~1\ONETOU~2.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Picasa Media Detector] D:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [OM_Monitor] D:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [OM_Monitor] D:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe
O4 - HKCU\..\Run: [BitTorrent] "D:\Program Files\BitTorrent\bittorrent.exe" –force_start_minimized
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: ERUNT AutoBackup.lnk = D:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: hotsync manager.lnk = D:\Program Files\Handspring\HOTSYNC.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: HP LaserJet 3150 Status.lnk = C:\jetsuite\JETSTAT.EXE
O4 - Global Startup: Live Menu.lnk = D:\Program Files\Common Files\efax\dllcmd32.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - D:\WINNT\System32\shdocvw.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - D:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: d:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {F4A1DC8A-3D7A-4C28-A5B6-C624B814A702} (Control Panel FileManager Uploader) - https://cp.aplus.net/tools/fileman/FileMan.cab
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - D:\WINNT\system32\bgsvcgen.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: jsdaemon - JetFax, Inc. - c:\jetsuite\jsdaemon.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINNT\system32\LEXBCES.EXE

I somehow lost the thread tothis so I hope that's what you needed.
Standing by….
Steve

Complete scanning result of "Glacier Bkgrd.jpg", processed in VirusTotal at 07/28/2007 02:01:23 (CET).

[ file data ]
* name: Glacier Bkgrd.jpg
* size: 2743
* md5.: 4186816d5c804e133ee2ea634348a6e8
* sha1: c96b8813e8b1ea157763cff82f9d0066979d5564

[ scan result ]
AhnLab-V3 2007.7.28.0/20070727 found nothing
AntiVir 7.4.0.50/20070727 found nothing
Authentium 4.93.8/20070727 found nothing
Avast 4.7.997.0/20070727 found nothing
AVG 7.5.0.476/20070727 found nothing
BitDefender 7.2/20070728 found nothing
CAT-QuickHeal 9.00/20070726 found nothing
ClamAV 0.91/20070728 found nothing
DrWeb 4.33/20070727 found nothing
eSafe 7.0.15.0/20070724 found nothing
eTrust-Vet 31.1.5010/20070728 found nothing
Ewido 4.0/20070727 found nothing
F-Prot 4.3.2.48/20070727 found nothing
F-Secure 6.70.13030.0/20070727 found nothing
FileAdvisor 1/20070728 found nothing
Fortinet 2.91.0.0/20070727 found nothing
Ikarus T3.1.1.8/20070727 found nothing
Kaspersky 4.0.2.24/20070728 found nothing
McAfee 5085/20070727 found nothing
Microsoft 1.2704/20070728 found nothing
NOD32v2 2426/20070727 found nothing
Norman 5.80.02/20070727 found nothing
Panda 9.0.0.4/20070727 found nothing
Prevx1 V2/20070728 found nothing
Rising 19.33.42.00/20070727 found nothing
Sophos 4.19.0/20070726 found nothing
Sunbelt 2.2.907.0/20070728 found nothing
Symantec 10/20070728 found nothing
TheHacker 6.1.7.155/20070727 found nothing
VBA32 3.12.2.1/20070727 found nothing
VirusBuster 4.3.26:9/20070727 found nothing
Webwasher-Gateway 6.0.1/20070728 found nothing

__________________________________________________
VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Do not reply to this message. It has been generated by an automatic address that will not handle any reply. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.

ComboFix 07-07-27.6 - "Steve" 07/27/2007 15:56:26.2 [GMT -6:00] - NTFS
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.True
Command switches used :: D:\WINNT\Profiles\Steve.000\Desktop\CFScript.txt


((((((((((((((((((((((((( Files Created from 2007-06-27 to 2007-07-27 )))))))))))))))))))))))))))))))


2007-07-27 15:56 16,384 –a—-t- D:\WINNT\system32\Perflib_Perfdata_3b8.dat
2007-07-27 15:40 d——– D:\Program Files\VirusTotalUploader
2007-07-27 12:04 16,384 –a—-t- D:\WINNT\system32\Perflib_Perfdata_67c.dat
2007-07-23 07:53 16,384 –a—-t- D:\WINNT\system32\Perflib_Perfdata_65c.dat
2007-07-04 00:42 d——– D:\WINNT\winsxs
2007-07-04 00:41 d——– D:\Program Files\MSECache
2007-07-03 23:27 51,200 –a—— D:\WINNT\nircmd.exe
2007-07-03 09:51 d——– D:\TEMP\ZB
2007-06-30 11:58 10,438 –a—— D:\dnsbak.reg
2007-06-20 10:36 69,632 –a—— D:\WINNT\system32\JSMUXMON.DLL
2007-06-20 10:36 59,604 –a—— D:\WINNT\system32\drivers\JSFAX.SYS
2007-06-20 10:36 56,672 –a—— D:\WINNT\system32\drivers\JSSCAN.SYS
2007-06-20 10:36 50,352 –a—— D:\WINNT\system32\drivers\JSDBG.SYS
2007-06-20 10:36 35,360 –a—— D:\WINNT\system32\JETRES16.DLL
2007-06-20 10:36 327,680 –a—— D:\WINNT\system32\JETRES32.DLL
2007-06-20 10:36 23,176 –a—— D:\WINNT\system32\JSUSD.DLL
2007-06-20 10:36 173,880 –a—— D:\WINNT\system32\drivers\JSMUX.SYS
2007-06-20 09:43 107,008 –a—— D:\WINNT\system32\HOTRES32.DLL
2007-06-20 08:16 36,864 -ra—— D:\WINNT\system32\RunSetup.dll
2007-06-19 19:38 d——– D:\WINNT\system32\SoftwareDistribution
2007-06-12 11:35 88,396 -ra—— D:\WINNT\system32\JF_JBIG.DLL
2007-06-12 11:35 149,680 -ra—— D:\WINNT\system32\HP3150PS.DLL
2007-06-08 08:37 d——– D:\tweek
2007-06-07 17:11 d——– D:\TEMP


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

12/20/02 11:54a 8352936 ——— D:\Program Files\RealOnePlayerV2GOLD.exe
12/03/02 11:47a 2598120 ——— D:\Program Files\Install_AIM.exe
11/23/06 08:51a 17515272 –a—— D:\Program Files\avg75free_430a848.exe
11/16/02 12:31p 768392 ——— D:\Program Files\Easy_CD__Installer.Exe
10/23/06 11:37a 6469352 –a—— D:\Program Files\avgas-setup-7.5.0.50.exe
10/20/06 08:28a 2566736 –a—— D:\Program Files\spywareblastersetup351.exe
09/07/04 09:39p 675 –a—— D:\WINNT\Profiles\Steve.000\APPLIC~1\tvmcwrd.dll
09/07/04 09:39p 2078 –a—— D:\WINNT\Profiles\Steve.000\APPLIC~1\tvmuknwrd.dll
07/27/07 03:45p ——— d——– D:\WINNT\Profiles\Steve.000\APPLIC~1\.purple
07/24/07 09:44a ——— d——– D:\WINNT\Profiles\Steve.000\APPLIC~1\gtk-2.0
07/11/07 09:52p 1636 –a—— D:\WINNT\system32\d3d9caps.dat
07/10/07 04:36p ——— d——– D:\WINNT\Profiles\Steve.000\APPLIC~1\ZoomBrowser EX
07/06/04 05:54p 170395 –a—— D:\WINNT\Profiles\Steve.000\APPLIC~1\tvmknwrd.dll
06/23/07 11:02p ——— d——– D:\Program Files\Google
06/20/07 10:36a ——— d-a—— D:\Program Files\Common Files\efax
05/21/02 04:09p 271 —h—– D:\Program Files\desktop.ini
05/21/02 04:09p 21952 —h—– D:\Program Files\folder.htt


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoxioDragToDisc"="D:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [12/09/03 07:24p]
"RoxioEngineUtility"="D:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [05/01/03 07:44p]
"projselector"="D:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" [12/09/03 07:37p]
"OneTouch Monitor"="D:\PROGRA~1\VISION~1\ONETOU~2.EXE" [10/16/01 08:08a]
"Adobe Photo Downloader"="D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [06/06/05 11:46p]
"Synchronization Manager"="mobsync.exe" [06/19/03 01:05p D:\WINNT\system32\mobsync.exe]
"AVG7_CC"="D:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [04/17/07 09:24a]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [10/25/06 07:58p]
"Picasa Media Detector"="D:\Program Files\Picasa2\PicasaMediaDetector.exe" [12/11/06 06:36p]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [10/30/06 10:36a]
"OM_Monitor"="D:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [05/16/06 06:50p]
"Tweak UI"="TWEAKUI.CPL" [06/18/00 02:03p D:\WINNT\system32\TWEAKUI.CPL]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" [11/15/04 07:48p]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OM_Monitor"="D:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" [05/16/06 06:51p]
"BitTorrent"="D:\Program Files\BitTorrent\bittorrent.exe" [11/29/06 09:50p]
"swg"="D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [07/15/07 06:50a]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{A213B520-C6C2-11d0-AF9D-008029E1027E}"= D:\Program Files\Symantec\WinFax\WfxSeh32.Dll [07/27/98 06:54a 38400]
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= c:\Program Files\InterMute\SpySubtract\sshook.dll [10/23/06 05:44p 77824]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, msnsspc.dll, digest.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXSUPMON]
D:\WINNT\system32\LXSUPMON.EXE RUN

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPWebCap]
D:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"D:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Synchronization Manager]
mobsync.exe /logon

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFaxAppPortStarter]
wfxsnt40.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" -atboottime

R1 Avg7RsNT;AVG7 Resident Driver NT;D:\WINNT\system32\Drivers\avg7rsnt.sys
R1 Cdr4_2K;Cdr4_2K;D:\WINNT\system32\drivers\Cdr4_2K.sys
R1 Cdralw2k;Cdralw2k;D:\WINNT\system32\drivers\Cdralw2k.sys
R1 cdrbsdrv;cdrbsdrv;D:\WINNT\system32\drivers\cdrbsdrv.sys
R1 cdudf;cdudf;D:\WINNT\system32\drivers\cdudf.sys
R1 jsmux;jsmux;D:\WINNT\system32\drivers\jsmux.sys
R1 jsscan;jsscan;D:\WINNT\system32\drivers\jsscan.sys
R1 PCLEPCI;PCLEPCI;\??\D:\WINNT\system32\drivers\pclepci.sys
R1 pwd_2k;pwd_2k;D:\WINNT\system32\drivers\pwd_2k.sys
R1 UdfReadr;UdfReadr;D:\WINNT\system32\drivers\UdfReadr.sys
R2 jsfax;jsfax;D:\WINNT\system32\drivers\jsfax.sys
R2 Nbf;NetBEUI Protocol;D:\WINNT\system32\DRIVERS\nbf.sys
R3 ASAPIW2k;ASAPIW2K;D:\WINNT\system32\drivers\ASAPIW2k.sys
R3 i81x;i81x;D:\WINNT\system32\DRIVERS\i81xnt5.sys
R3 MarvinBus;Pinnacle Marvin Bus;D:\WINNT\system32\DRIVERS\MarvinBus.sys
R3 mmc_2K;mmc_2K;D:\WINNT\system32\drivers\mmc_2K.sys
R3 ngrpci;NETGEAR FA310TX Fast Ethernet Adapter Driver;D:\WINNT\system32\DRIVERS\ngrpci.sys
R3 usbprint;Microsoft USB PRINTER Class;D:\WINNT\system32\DRIVERS\usbprint.sys
S1 i81xnt4;i81xnt4;D:\WINNT\system32\DRIVERS\i81xnt4.sys
S1 sglfb;sglfb;D:\WINNT\system32\drivers\sglfb.sys
S2 Cdralwnt;Cdralwnt;D:\WINNT\system32\drivers\Cdralwnt.sys
S2 Scsiprnt;Scsiprnt;D:\WINNT\system32\drivers\Scsiprnt.sys
S3 dvd_2K;dvd_2K;D:\WINNT\system32\drivers\dvd_2K.sys
S3 grmnusb;grmnusb;D:\WINNT\system32\drivers\grmnusb.sys
S3 MPE;BDA MPE Filter;D:\WINNT\system32\DRIVERS\MPE.sys
S3 MSDV;Microsoft DV Camera and VCR;D:\WINNT\system32\DRIVERS\msdv.sys
S3 pmxscan;Visioneer USB Kernel;D:\WINNT\system32\DRIVERS\usbscan.sys
S3 ROOTMODEM;Microsoft Legacy Modem Driver;D:\WINNT\system32\Drivers\RootMdm.sys
S3 TPPFX;USB Storage Adapter FX (TPP);D:\WINNT\system32\DRIVERS\TPPFX.SYS
S3 USB20L;Linksys USB 2.0 10/100 Adapter;D:\WINNT\system32\DRIVERS\USB200M.sys
S3 VisorUsb;Handspring USB;D:\WINNT\system32\DRIVERS\VisorUsb.sys
S4 ensqio;ensqio;D:\WINNT\system32\DRIVERS\ensqio.sys
S4 jsdbg;jsdbg;D:\WINNT\system32\drivers\jsdbg.sys
S4 wfxsvc;WinFax PRO;D:\WINNT\System32\WFXSVC.EXE


Contents of the 'Scheduled Tasks' folder
2007-07-21 04:00:06 D:\WINNT\tasks\Daily Backup.job
2007-07-27 20:49:03 D:\WINNT\tasks\Daily2.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-27 15:58:52
Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes …

scanning hidden registry entries …

source file error: D:\WINNT\Profiles\STEVE~~1\ntuser.dat
scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 07/27/2007 16:00:30
D:\ComboFix-quarantined-files.txt … 07/27/07 03:59p
D:\ComboFix2.txt … 07/27/07 10:07a

— E O F —
KASPERSKY ONLINE SCANNER REPORT
Friday, July 27, 2007 22:07
Operating System: Microsoft Windows 2000 Professional, Service Pack 4 (Build 2195)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 28/07/2007
Kaspersky Anti-Virus database records: 368723


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\
F:\

Scan Statistics
Total number of scanned objects 99155
Number of viruses found 14
Number of infected objects 35
Number of suspicious objects 3
Duration of the scan process 05:27:59

Infected Object Name Virus Name Last Action
C:\archive.pst Object is locked skipped

D:\TEMP\JET47C6.tmp Object is locked skipped

D:\TEMP\JET6061.tmp Object is locked skipped

D:\WINNT\CSC\000001 Object is locked skipped

D:\WINNT\Debug\ipsecpa.log Object is locked skipped

D:\WINNT\Debug\oakley.log Object is locked skipped

D:\WINNT\Debug\PASSWD.LOG Object is locked skipped

D:\WINNT\Profiles\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped

D:\WINNT\Profiles\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped

D:\WINNT\Profiles\Steve.000\Application Data\Microsoft\Outlook\Microsoft Outlook Internet Settings.NK2 Object is locked skipped

D:\WINNT\Profiles\Steve.000\Application Data\Microsoft\Outlook\Microsoft Outlook Internet Settings.srs Object is locked skipped

D:\WINNT\Profiles\Steve.000\Application Data\Microsoft\Templates\Normal.dot Object is locked skipped

D:\WINNT\Profiles\Steve.000\Cookies\index.dat Object is locked skipped

D:\WINNT\Profiles\Steve.000\Desktop\ComboFix 072707.doc Object is locked skipped

D:\WINNT\Profiles\Steve.000\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

D:\WINNT\Profiles\Steve.000\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

D:\WINNT\Profiles\Steve.000\Local Settings\History\History.IE5\index.dat Object is locked skipped

D:\WINNT\Profiles\Steve.000\Local Settings\Temp\~DF53A1.tmp Object is locked skipped

D:\WINNT\Profiles\Steve.000\Local Settings\Temp\~DFF105.tmp Object is locked skipped

D:\WINNT\Profiles\Steve.000\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

D:\WINNT\Profiles\Steve.000\NTUSER.DAT Object is locked skipped

D:\WINNT\Profiles\Steve.000\ntuser.dat.LOG Object is locked skipped

D:\WINNT\SchedLgU.Txt Object is locked skipped

D:\WINNT\SoftwareDistribution\DataStore\DataStore.edb Object is locked skipped

D:\WINNT\SoftwareDistribution\DataStore\Logs\edb.log Object is locked skipped

D:\WINNT\SoftwareDistribution\DataStore\Logs\tmp.edb Object is locked skipped

D:\WINNT\SoftwareDistribution\EventCache\{85EC9B3B-13D0-45F8-9BE2-12B96CB7AA1C}.bin Object is locked skipped

D:\WINNT\SoftwareDistribution\ReportingEvents.log Object is locked skipped

D:\WINNT\Sti_Trace.log Object is locked skipped

D:\WINNT\system32\aisysUS.exe/data0002 Infected: Trojan-Downloader.Win32.Apropo.e skipped

D:\WINNT\system32\aisysUS.exe/data0003 Infected: Trojan-Downloader.Win32.Vivia.n skipped

D:\WINNT\system32\aisysUS.exe NSIS: infected - 2 skipped

D:\WINNT\system32\bisys.exe/data0002 Infected: Trojan.Win32.Revop.c skipped

D:\WINNT\system32\bisys.exe/data0003 Infected: Trojan-Downloader.Win32.Vivia.n skipped

D:\WINNT\system32\bisys.exe NSIS: infected - 2 skipped

D:\WINNT\system32\config\AppEvent.Evt Object is locked skipped

D:\WINNT\system32\config\default Object is locked skipped

D:\WINNT\system32\config\DEFAULT.LOG Object is locked skipped

D:\WINNT\system32\config\SAM Object is locked skipped

D:\WINNT\system32\config\SAM.LOG Object is locked skipped

D:\WINNT\system32\config\SecEvent.Evt Object is locked skipped

D:\WINNT\system32\config\SECURITY Object is locked skipped

D:\WINNT\system32\config\SECURITY.LOG Object is locked skipped

D:\WINNT\system32\config\software Object is locked skipped

D:\WINNT\system32\config\SOFTWARE.LOG Object is locked skipped

D:\WINNT\system32\config\SysEvent.Evt Object is locked skipped

D:\WINNT\system32\config\system Object is locked skipped

D:\WINNT\system32\config\SYSTEM.ALT Object is locked skipped

D:\WINNT\system32\dmksys.exe/data0002/data0002 Infected: not-a-virus:AdWare.Win32.BookedSpace.c skipped

D:\WINNT\system32\dmksys.exe/data0002 Infected: not-a-virus:AdWare.Win32.BookedSpace.c skipped

D:\WINNT\system32\dmksys.exe/data0003 Infected: Trojan-Downloader.Win32.Vivia.n skipped

D:\WINNT\system32\dmksys.exe NSIS: infected - 3 skipped

D:\WINNT\system32\ezsys.exe/data0002 Infected: not-a-virus:AdWare.Win32.EZula.o skipped

D:\WINNT\system32\ezsys.exe/data0003 Infected: Trojan-Downloader.Win32.Vivia.n skipped

D:\WINNT\system32\ezsys.exe NSIS: infected - 2 skipped

D:\WINNT\system32\ias\dnary.ldb Object is locked skipped

D:\WINNT\system32\ias\ias.ldb Object is locked skipped

D:\WINNT\system32\ias\ias.mdb Object is locked skipped

D:\WINNT\system32\ibissys.exe/data0002 Infected: Trojan-Downloader.Win32.Vivia.o skipped

D:\WINNT\system32\ibissys.exe/data0003 Infected: Trojan-Downloader.Win32.QDown.j skipped

D:\WINNT\system32\ibissys.exe NSIS: infected - 2 skipped

D:\WINNT\system32\inetkwsys.exe/data0002/data0008 Infected: not-a-virus:AdWare.Win32.CommonName.d skipped

D:\WINNT\system32\inetkwsys.exe/data0002/data0009 Infected: not-a-virus:AdWare.Win32.CommonName.d skipped

D:\WINNT\system32\inetkwsys.exe/data0002/data0010 Infected: not-a-virus:AdWare.Win32.CommonName.d skipped

D:\WINNT\system32\inetkwsys.exe/data0002 Infected: not-a-virus:AdWare.Win32.CommonName.d skipped

D:\WINNT\system32\inetkwsys.exe/data0003 Infected: Trojan-Downloader.Win32.Vivia.p skipped

D:\WINNT\system32\inetkwsys.exe NSIS: infected - 5 skipped

D:\WINNT\system32\keywordsys.exe/data0002/data236684.zip/Setup.exe/0002\F7\srchfstu.exe Infected: not-a-virus:AdWare.Win32.SearchFast.a skipped

D:\WINNT\system32\keywordsys.exe/data0002/data236684.zip/Setup.exe/0002\F7\srchupdt.exe Infected: not-a-virus:AdWare.Win32.SearchFast.a skipped

D:\WINNT\system32\keywordsys.exe/data0002/data236684.zip/Setup.exe Infected: not-a-virus:AdWare.Win32.SearchFast.a skipped

D:\WINNT\system32\keywordsys.exe/data0002/data236684.zip Infected: not-a-virus:AdWare.Win32.SearchFast.a skipped

D:\WINNT\system32\keywordsys.exe/data0002 Infected: not-a-virus:AdWare.Win32.SearchFast.a skipped

D:\WINNT\system32\keywordsys.exe/data0003 Infected: Trojan-Downloader.Win32.Vivia.o skipped

D:\WINNT\system32\keywordsys.exe NSIS: infected - 6 skipped

D:\WINNT\system32\lzreg.exe/data0002 Infected: Trojan-Downloader.Win32.Vivia.i skipped

D:\WINNT\system32\lzreg.exe NSIS: infected - 1 skipped

D:\WINNT\system32\Perflib_Perfdata_3b8.dat Object is locked skipped

D:\WINNT\system32\Perflib_Perfdata_67c.dat Object is locked skipped

D:\WINNT\WindowsUpdate.log Object is locked skipped

F:\archive.pst/Archive Folders/Sent Items/29 Apr 2002 14:34 to jerryblack:RE: Marginheight.html Suspicious: Exploit.HTML.Iframe.FileDownload skipped

F:\archive.pst/Archive Folders/Sent Items/29 Apr 2002 19:32 to Black, Jerry:RE: Marginheight.html Suspicious: Exploit.HTML.Iframe.FileDownload skipped

F:\archive.pst Mail MS Mail: suspicious - 2 skipped

F:\Lisa\backup lisa's laptop\outlook.pst/Personal Folders/Inbox/25 Aug 2005 19:12 from [removed]:**Possible_Spam**/Details.doc Infected: Net-Worm.Win32.Lebreat.m skipped

F:\Lisa\backup lisa's laptop\outlook.pst/Personal Folders/Inbox/12 Sep 2005 21:40 from Mail Delivery System:Undelivered Mail Ret/12 Sep 2005 21:33 to Lisah/newprice.zip/price.cpl Infected: Email-Worm.Win32.Bagle.ct skipped

F:\Lisa\backup lisa's laptop\outlook.pst/Personal Folders/Inbox/12 Sep 2005 21:40 from Mail Delivery System:Undelivered Mail Ret/12 Sep 2005 21:33 to Lisah/newprice.zip Infected: Email-Worm.Win32.Bagle.ct skipped

F:\Lisa\backup lisa's laptop\outlook.pst Mail MS Mail: infected - 3 skipped

F:\My Documents\Steve.pst Object is locked skipped

Scan was interrupted by user! I stopped the scan because it seemed to be hung up at 80% and the only action was the time clock ticking, but no more scanning.

The following HJT file was done after these other scans, but I did NOT reboot before it did it.(if that makes a difference)
Logfile of HijackThis v1.99.1
Scan saved at 22:17, on 7/27/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP1 (5.00.2920.0000)

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\LEXBCES.EXE
D:\WINNT\system32\spoolsv.exe
D:\WINNT\system32\LEXPPS.EXE
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
D:\WINNT\system32\bgsvcgen.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\WINNT\System32\svchost.exe
c:\jetsuite\jsdaemon.exe
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\MSTask.exe
D:\WINNT\system32\stisvc.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\WINNT\system32\mspmspsv.exe
D:\WINNT\system32\svchost.exe
D:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
D:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe
D:\PROGRA~1\VISION~1\ONETOU~2.EXE
D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
D:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\Picasa2\PicasaMediaDetector.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\jetsuite\JETSTAT.EXE
D:\Program Files\Common Files\efax\dllcmd32.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
D:\Program Files\Handspring\HOTSYNC.EXE
D:\Program Files\iPod\bin\iPodService.exe
D:\WINNT\system32\wuauclt.exe
D:\WINNT\System32\svchost.exe
c:\jetsuite\JSFMAN.EXE
F:\Program Files\OFFICE11\OUTLOOK.EXE
D:\Program Files\Pidgin\pidgin.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\WINNT\system32\notepad.exe
D:\ComboFix\regt.cfexe
D:\WINNT\explorer.exe
F:\Program Files\OFFICE11\WINWORD.EXE
D:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigmtn.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [RoxioDragToDisc] "D:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "D:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [projselector] "D:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" -r
O4 - HKLM\..\Run: [OneTouch Monitor] D:\PROGRA~1\VISION~1\ONETOU~2.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Picasa Media Detector] D:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [OM_Monitor] D:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [OM_Monitor] D:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe
O4 - HKCU\..\Run: [BitTorrent] "D:\Program Files\BitTorrent\bittorrent.exe" –force_start_minimized
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: HP LaserJet 3150 Status.lnk = C:\jetsuite\JETSTAT.EXE
O4 - Global Startup: Live Menu.lnk = D:\Program Files\Common Files\efax\dllcmd32.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - D:\WINNT\System32\shdocvw.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - D:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: d:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {F4A1DC8A-3D7A-4C28-A5B6-C624B814A702} (Control Panel FileManager Uploader) - https://cp.aplus.net/tools/fileman/FileMan.cab
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - D:\WINNT\system32\bgsvcgen.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: jsdaemon - JetFax, Inc. - c:\jetsuite\jsdaemon.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINNT\system32\LEXBCES.EXE

Here's the combofix file, plus I submitted a malware file to bleeping computer (the told me to tell you).
-s
ComboFix 07-07-27.6 - "Steve" 2007-07-30 0:23:24.3 [GMT -6:00] - NTFS
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.True
Command switches used :: D:\WINNT\Profiles\Steve.000\Desktop\CFScript072907.txt


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


D:\TEMP . . . . failed to delete
D:\TEMP\JET1FD2.tmp
D:\TEMP\JET2307.tmp
D:\TEMP\JET297B.tmp
D:\TEMP\JET4C42.tmp
D:\TEMP\JET5465.tmp
D:\TEMP\JET570E.tmp
D:\TEMP\JET627A.tmp
D:\TEMP\JET6F9F.tmp
D:\TEMP\JET7C9C.tmp
D:\TEMP\JET84F1.tmp
D:\TEMP\JET86D2.tmp
D:\TEMP\JET8BCA.tmp
D:\TEMP\JETA0C3.tmp
D:\TEMP\JETA7CE.tmp
D:\TEMP\JETA7F6.tmp
D:\TEMP\JETB0FF.tmp
D:\TEMP\ZB\SimplePrint.xml
D:\WINNT\Profiles\Steve.000\APPLICATION DATA\tvmcwrd.dll
D:\WINNT\Profiles\Steve.000\APPLICATION DATA\tvmknwrd.dll
D:\WINNT\Profiles\Steve.000\APPLICATION DATA\tvmuknwrd.dll
D:\WINNT\system32\aisysUS.exe
D:\WINNT\system32\bisys.exe
D:\WINNT\system32\dmksys.exe
D:\WINNT\system32\ezsys.exe
D:\WINNT\system32\ibissys.exe
D:\WINNT\system32\inetkwsys.exe
D:\WINNT\system32\keywordsys.exe
D:\WINNT\system32\lzreg.exe


((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-30 )))))))))))))))))))))))))))))))


2007-07-30 00:28 d——– D:\TEMP
2007-07-27 16:07 d——– D:\WINNT\system32\Kaspersky Lab
2007-07-27 16:07 d——– D:\WINNT\Profiles\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-07-27 15:40 d——– D:\Program Files\VirusTotalUploader
2007-07-04 00:42 d——– D:\WINNT\winsxs
2007-07-04 00:41 d——– D:\Program Files\MSECache
2007-07-03 23:27 51,200 –a—— D:\WINNT\nircmd.exe
2007-06-30 11:58 10,438 –a—— D:\dnsbak.reg
2007-06-20 10:36 69,632 –a—— D:\WINNT\system32\JSMUXMON.DLL
2007-06-20 10:36 59,604 –a—— D:\WINNT\system32\drivers\JSFAX.SYS
2007-06-20 10:36 56,672 –a—— D:\WINNT\system32\drivers\JSSCAN.SYS
2007-06-20 10:36 50,352 –a—— D:\WINNT\system32\drivers\JSDBG.SYS
2007-06-20 10:36 35,360 –a—— D:\WINNT\system32\JETRES16.DLL
2007-06-20 10:36 327,680 –a—— D:\WINNT\system32\JETRES32.DLL
2007-06-20 10:36 23,176 –a—— D:\WINNT\system32\JSUSD.DLL
2007-06-20 10:36 173,880 –a—— D:\WINNT\system32\drivers\JSMUX.SYS
2007-06-20 09:43 107,008 –a—— D:\WINNT\system32\HOTRES32.DLL
2007-06-20 08:16 36,864 -ra—— D:\WINNT\system32\RunSetup.dll
2007-06-19 19:38 d——– D:\WINNT\system32\SoftwareDistribution
2007-06-12 11:35 88,396 -ra—— D:\WINNT\system32\JF_JBIG.DLL
2007-06-12 11:35 149,680 -ra—— D:\WINNT\system32\HP3150PS.DLL
2007-06-08 08:37 d——– D:\tweek


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

07-07-29 21:10 1636 –a—— D:\WINNT\system32\d3d9caps.dat
07-07-27 22:33 ——— d——– D:\WINNT\Profiles\Steve.000\APPLIC~1\.purple
07-07-24 09:44 ——— d——– D:\WINNT\Profiles\Steve.000\APPLIC~1\gtk-2.0
07-07-10 16:36 ——— d——– D:\WINNT\Profiles\Steve.000\APPLIC~1\ZoomBrowser EX
07-06-23 23:02 ——— d——– D:\Program Files\Google
07-06-20 10:36 ——— d-a—— D:\Program Files\Common Files\efax
06-11-23 08:51 17515272 –a—— D:\Program Files\avg75free_430a848.exe
06-10-23 11:37 6469352 –a—— D:\Program Files\avgas-setup-7.5.0.50.exe
06-10-20 08:28 2566736 –a—— D:\Program Files\spywareblastersetup351.exe
02-12-20 11:54 8352936 ——— D:\Program Files\RealOnePlayerV2GOLD.exe
02-12-03 11:47 2598120 ——— D:\Program Files\Install_AIM.exe
02-11-16 12:31 768392 ——— D:\Program Files\Easy_CD__Installer.Exe
02-05-21 16:09 271 —h—– D:\Program Files\desktop.ini
02-05-21 16:09 21952 —h—– D:\Program Files\folder.htt


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoxioDragToDisc"="D:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [03-12-09 19:24 ]
"RoxioEngineUtility"="D:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [03-05-01 19:44 ]
"projselector"="D:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" [03-12-09 19:37 ]
"OneTouch Monitor"="D:\PROGRA~1\VISION~1\ONETOU~2.EXE" [01-10-16 08:08 ]
"Adobe Photo Downloader"="D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [05-06-06 23:46 ]
"Synchronization Manager"="mobsync.exe" [03-06-19 13:05 D:\WINNT\system32\mobsync.exe]
"AVG7_CC"="D:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [07-04-17 09:24 ]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [06-10-25 19:58 ]
"Picasa Media Detector"="D:\Program Files\Picasa2\PicasaMediaDetector.exe" [06-12-11 18:36 ]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [06-10-30 10:36 ]
"OM_Monitor"="D:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [06-05-16 18:50 ]
"Tweak UI"="TWEAKUI.CPL" [00-06-18 14:03 D:\WINNT\system32\TWEAKUI.CPL]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" [04-11-15 19:48 ]
"combofix"="D:\WINNT\system32\cmd.exe" [04-11-02 16:48 ]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OM_Monitor"="D:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" [06-05-16 18:51 ]
"BitTorrent"="D:\Program Files\BitTorrent\bittorrent.exe" [06-11-29 21:50 ]
"swg"="D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [07-07-15 06:50 ]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [06-10-25 19:58 ]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop

D:\WINNT\Profiles\Steve.000\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - D:\Program Files\ERUNT\AUTOBACK.EXE [2005-10-20 12:04:08]
hotsync manager.lnk - D:\Program Files\Handspring\HOTSYNC.EXE [2003-04-17 21:55:58]

D:\WINNT\Profiles\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk.disabled [2006-06-01 22:01:50]
HP LaserJet 3150 Status.lnk - C:\jetsuite\JETSTAT.EXE [2007-06-20 10:36:23]
Live Menu.lnk - D:\Program Files\Common Files\efax\dllcmd32.exe [2007-06-20 10:36:22]
SpySubtract.lnk - C:\Program Files\InterMute\SpySubtract\SpySub.exe [2006-10-23 17:44:26]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{A213B520-C6C2-11d0-AF9D-008029E1027E}"= D:\Program Files\Symantec\WinFax\WfxSeh32.Dll [98-07-27 06:54 38400]
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= c:\Program Files\InterMute\SpySubtract\sshook.dll [06-10-23 17:44 77824]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, msnsspc.dll, digest.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXSUPMON]
D:\WINNT\system32\LXSUPMON.EXE RUN

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPWebCap]
D:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"D:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Synchronization Manager]
mobsync.exe /logon

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFaxAppPortStarter]
wfxsnt40.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" -atboottime

R1 Avg7RsNT;AVG7 Resident Driver NT;D:\WINNT\system32\Drivers\avg7rsnt.sys
R1 Cdr4_2K;Cdr4_2K;D:\WINNT\system32\drivers\Cdr4_2K.sys
R1 Cdralw2k;Cdralw2k;D:\WINNT\system32\drivers\Cdralw2k.sys
R1 cdrbsdrv;cdrbsdrv;D:\WINNT\system32\drivers\cdrbsdrv.sys
R1 cdudf;cdudf;D:\WINNT\system32\drivers\cdudf.sys
R1 jsmux;jsmux;D:\WINNT\system32\drivers\jsmux.sys
R1 jsscan;jsscan;D:\WINNT\system32\drivers\jsscan.sys
R1 PCLEPCI;PCLEPCI;\??\D:\WINNT\system32\drivers\pclepci.sys
R1 pwd_2k;pwd_2k;D:\WINNT\system32\drivers\pwd_2k.sys
R1 UdfReadr;UdfReadr;D:\WINNT\system32\drivers\UdfReadr.sys
R2 jsfax;jsfax;D:\WINNT\system32\drivers\jsfax.sys
R2 Nbf;NetBEUI Protocol;D:\WINNT\system32\DRIVERS\nbf.sys
R3 ASAPIW2k;ASAPIW2K;D:\WINNT\system32\drivers\ASAPIW2k.sys
R3 i81x;i81x;D:\WINNT\system32\DRIVERS\i81xnt5.sys
R3 MarvinBus;Pinnacle Marvin Bus;D:\WINNT\system32\DRIVERS\MarvinBus.sys
R3 mmc_2K;mmc_2K;D:\WINNT\system32\drivers\mmc_2K.sys
R3 ngrpci;NETGEAR FA310TX Fast Ethernet Adapter Driver;D:\WINNT\system32\DRIVERS\ngrpci.sys
R3 TPPFX;USB Storage Adapter FX (TPP);D:\WINNT\system32\DRIVERS\TPPFX.SYS
R3 usbprint;Microsoft USB PRINTER Class;D:\WINNT\system32\DRIVERS\usbprint.sys
S1 i81xnt4;i81xnt4;D:\WINNT\system32\DRIVERS\i81xnt4.sys
S1 sglfb;sglfb;D:\WINNT\system32\drivers\sglfb.sys
S2 Cdralwnt;Cdralwnt;D:\WINNT\system32\drivers\Cdralwnt.sys
S2 Scsiprnt;Scsiprnt;D:\WINNT\system32\drivers\Scsiprnt.sys
S3 dvd_2K;dvd_2K;D:\WINNT\system32\drivers\dvd_2K.sys
S3 grmnusb;grmnusb;D:\WINNT\system32\drivers\grmnusb.sys
S3 MPE;BDA MPE Filter;D:\WINNT\system32\DRIVERS\MPE.sys
S3 MSDV;Microsoft DV Camera and VCR;D:\WINNT\system32\DRIVERS\msdv.sys
S3 pmxscan;Visioneer USB Kernel;D:\WINNT\system32\DRIVERS\usbscan.sys
S3 ROOTMODEM;Microsoft Legacy Modem Driver;D:\WINNT\system32\Drivers\RootMdm.sys
S3 USB20L;Linksys USB 2.0 10/100 Adapter;D:\WINNT\system32\DRIVERS\USB200M.sys
S3 VisorUsb;Handspring USB;D:\WINNT\system32\DRIVERS\VisorUsb.sys
S4 ensqio;ensqio;D:\WINNT\system32\DRIVERS\ensqio.sys
S4 jsdbg;jsdbg;D:\WINNT\system32\drivers\jsdbg.sys
S4 wfxsvc;WinFax PRO;D:\WINNT\System32\WFXSVC.EXE


Contents of the 'Scheduled Tasks' folder
2007-07-28 04:00:30 D:\WINNT\tasks\Daily Backup.job
2007-07-29 21:18:50 D:\WINNT\tasks\Daily2.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-30 00:39:42
Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

D:\WINNT\system32\Perflib_Perfdata_678.dat

scan completed successfully
hidden files: 1

**************************************************************************

Completion time: 2007-07-30 0:43:10 - machine was rebooted
D:\ComboFix-quarantined-files.txt … 07-07-30 00:42
D:\ComboFix2.txt … 07-07-27 16:00
D:\ComboFix3.txt … 07-07-27 10:07

— E O F —

new combofix fileComboFix 07-07-27.6 - "Steve" 07/30/2007 9:28:44.4 [GMT -6:00] - NTFS
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.True
Command switches used :: D:\WINNT\Profiles\Steve.000\Desktop\CFScript72907.txt


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


D:\TEMP . . . . failed to delete


((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-30 )))))))))))))))))))))))))))))))


2007-07-30 00:28 d——– D:\TEMP
2007-07-27 16:07 d——– D:\WINNT\system32\Kaspersky Lab
2007-07-27 16:07 d——– D:\WINNT\Profiles\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-07-27 15:40 d——– D:\Program Files\VirusTotalUploader
2007-07-04 00:42 d——– D:\WINNT\winsxs
2007-07-04 00:41 d——– D:\Program Files\MSECache
2007-07-03 23:27 51,200 –a—— D:\WINNT\nircmd.exe
2007-06-30 11:58 10,438 –a—— D:\dnsbak.reg
2007-06-20 10:36 69,632 –a—— D:\WINNT\system32\JSMUXMON.DLL
2007-06-20 10:36 59,604 –a—— D:\WINNT\system32\drivers\JSFAX.SYS
2007-06-20 10:36 56,672 –a—— D:\WINNT\system32\drivers\JSSCAN.SYS
2007-06-20 10:36 50,352 –a—— D:\WINNT\system32\drivers\JSDBG.SYS
2007-06-20 10:36 35,360 –a—— D:\WINNT\system32\JETRES16.DLL
2007-06-20 10:36 327,680 –a—— D:\WINNT\system32\JETRES32.DLL
2007-06-20 10:36 23,176 –a—— D:\WINNT\system32\JSUSD.DLL
2007-06-20 10:36 173,880 –a—— D:\WINNT\system32\drivers\JSMUX.SYS
2007-06-20 09:43 107,008 –a—— D:\WINNT\system32\HOTRES32.DLL
2007-06-20 08:16 36,864 -ra—— D:\WINNT\system32\RunSetup.dll
2007-06-19 19:38 d——– D:\WINNT\system32\SoftwareDistribution
2007-06-12 11:35 88,396 -ra—— D:\WINNT\system32\JF_JBIG.DLL
2007-06-12 11:35 149,680 -ra—— D:\WINNT\system32\HP3150PS.DLL
2007-06-08 08:37 d——– D:\tweek


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

07-07-29 21:10 1636 –a—— D:\WINNT\system32\d3d9caps.dat
07-07-27 22:33 ——— d——– D:\WINNT\Profiles\Steve.000\APPLIC~1\.purple
07-07-24 09:44 ——— d——– D:\WINNT\Profiles\Steve.000\APPLIC~1\gtk-2.0
07-07-10 16:36 ——— d——– D:\WINNT\Profiles\Steve.000\APPLIC~1\ZoomBrowser EX
07-06-23 23:02 ——— d——– D:\Program Files\Google
07-06-20 10:36 ——— d-a—— D:\Program Files\Common Files\efax
06-11-23 08:51 17515272 –a—— D:\Program Files\avg75free_430a848.exe
06-10-23 11:37 6469352 –a—— D:\Program Files\avgas-setup-7.5.0.50.exe
06-10-20 08:28 2566736 –a—— D:\Program Files\spywareblastersetup351.exe
02-12-20 11:54 8352936 ——— D:\Program Files\RealOnePlayerV2GOLD.exe
02-12-03 11:47 2598120 ——— D:\Program Files\Install_AIM.exe
02-11-16 12:31 768392 ——— D:\Program Files\Easy_CD__Installer.Exe
02-05-21 16:09 271 —h—– D:\Program Files\desktop.ini
02-05-21 16:09 21952 —h—– D:\Program Files\folder.htt


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoxioDragToDisc"="D:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [03-12-09 19:24 ]
"RoxioEngineUtility"="D:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [03-05-01 19:44 ]
"projselector"="D:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" [03-12-09 19:37 ]
"OneTouch Monitor"="D:\PROGRA~1\VISION~1\ONETOU~2.EXE" [01-10-16 08:08 ]
"Adobe Photo Downloader"="D:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [05-06-06 23:46 ]
"Synchronization Manager"="mobsync.exe" [03-06-19 13:05 D:\WINNT\system32\mobsync.exe]
"AVG7_CC"="D:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [07-04-17 09:24 ]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [06-10-25 19:58 ]
"Picasa Media Detector"="D:\Program Files\Picasa2\PicasaMediaDetector.exe" [06-12-11 18:36 ]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [06-10-30 10:36 ]
"OM_Monitor"="D:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [06-05-16 18:50 ]
"Tweak UI"="TWEAKUI.CPL" [00-06-18 14:03 D:\WINNT\system32\TWEAKUI.CPL]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" [04-11-15 19:48 ]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OM_Monitor"="D:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" [06-05-16 18:51 ]
"BitTorrent"="D:\Program Files\BitTorrent\bittorrent.exe" [06-11-29 21:50 ]
"swg"="D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [07-07-15 06:50 ]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [06-10-25 19:58 ]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop

D:\WINNT\Profiles\Steve.000\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - D:\Program Files\ERUNT\AUTOBACK.EXE [2005-10-20 12:04:08]
hotsync manager.lnk - D:\Program Files\Handspring\HOTSYNC.EXE [2003-04-17 21:55:58]

D:\WINNT\Profiles\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk.disabled [2006-06-01 22:01:50]
HP LaserJet 3150 Status.lnk - C:\jetsuite\JETSTAT.EXE [2007-06-20 10:36:23]
Live Menu.lnk - D:\Program Files\Common Files\efax\dllcmd32.exe [2007-06-20 10:36:22]
SpySubtract.lnk - C:\Program Files\InterMute\SpySubtract\SpySub.exe [2006-10-23 17:44:26]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{A213B520-C6C2-11d0-AF9D-008029E1027E}"= D:\Program Files\Symantec\WinFax\WfxSeh32.Dll [98-07-27 06:54 38400]
"{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= c:\Program Files\InterMute\SpySubtract\sshook.dll [06-10-23 17:44 77824]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, msnsspc.dll, digest.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXSUPMON]
D:\WINNT\system32\LXSUPMON.EXE RUN

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPWebCap]
D:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"D:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Synchronization Manager]
mobsync.exe /logon

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFaxAppPortStarter]
wfxsnt40.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" -atboottime

R1 Avg7RsNT;AVG7 Resident Driver NT;D:\WINNT\system32\Drivers\avg7rsnt.sys
R1 Cdr4_2K;Cdr4_2K;D:\WINNT\system32\drivers\Cdr4_2K.sys
R1 Cdralw2k;Cdralw2k;D:\WINNT\system32\drivers\Cdralw2k.sys
R1 cdrbsdrv;cdrbsdrv;D:\WINNT\system32\drivers\cdrbsdrv.sys
R1 cdudf;cdudf;D:\WINNT\system32\drivers\cdudf.sys
R1 jsmux;jsmux;D:\WINNT\system32\drivers\jsmux.sys
R1 jsscan;jsscan;D:\WINNT\system32\drivers\jsscan.sys
R1 PCLEPCI;PCLEPCI;\??\D:\WINNT\system32\drivers\pclepci.sys
R1 pwd_2k;pwd_2k;D:\WINNT\system32\drivers\pwd_2k.sys
R1 UdfReadr;UdfReadr;D:\WINNT\system32\drivers\UdfReadr.sys
R2 jsfax;jsfax;D:\WINNT\system32\drivers\jsfax.sys
R2 Nbf;NetBEUI Protocol;D:\WINNT\system32\DRIVERS\nbf.sys
R3 ASAPIW2k;ASAPIW2K;D:\WINNT\system32\drivers\ASAPIW2k.sys
R3 i81x;i81x;D:\WINNT\system32\DRIVERS\i81xnt5.sys
R3 MarvinBus;Pinnacle Marvin Bus;D:\WINNT\system32\DRIVERS\MarvinBus.sys
R3 mmc_2K;mmc_2K;D:\WINNT\system32\drivers\mmc_2K.sys
R3 ngrpci;NETGEAR FA310TX Fast Ethernet Adapter Driver;D:\WINNT\system32\DRIVERS\ngrpci.sys
R3 TPPFX;USB Storage Adapter FX (TPP);D:\WINNT\system32\DRIVERS\TPPFX.SYS
R3 usbprint;Microsoft USB PRINTER Class;D:\WINNT\system32\DRIVERS\usbprint.sys
S1 i81xnt4;i81xnt4;D:\WINNT\system32\DRIVERS\i81xnt4.sys
S1 sglfb;sglfb;D:\WINNT\system32\drivers\sglfb.sys
S2 Cdralwnt;Cdralwnt;D:\WINNT\system32\drivers\Cdralwnt.sys
S2 Scsiprnt;Scsiprnt;D:\WINNT\system32\drivers\Scsiprnt.sys
S3 dvd_2K;dvd_2K;D:\WINNT\system32\drivers\dvd_2K.sys
S3 grmnusb;grmnusb;D:\WINNT\system32\drivers\grmnusb.sys
S3 MPE;BDA MPE Filter;D:\WINNT\system32\DRIVERS\MPE.sys
S3 MSDV;Microsoft DV Camera and VCR;D:\WINNT\system32\DRIVERS\msdv.sys
S3 pmxscan;Visioneer USB Kernel;D:\WINNT\system32\DRIVERS\usbscan.sys
S3 ROOTMODEM;Microsoft Legacy Modem Driver;D:\WINNT\system32\Drivers\RootMdm.sys
S3 USB20L;Linksys USB 2.0 10/100 Adapter;D:\WINNT\system32\DRIVERS\USB200M.sys
S3 VisorUsb;Handspring USB;D:\WINNT\system32\DRIVERS\VisorUsb.sys
S4 ensqio;ensqio;D:\WINNT\system32\DRIVERS\ensqio.sys
S4 jsdbg;jsdbg;D:\WINNT\system32\drivers\jsdbg.sys
S4 wfxsvc;WinFax PRO;D:\WINNT\System32\WFXSVC.EXE


Contents of the 'Scheduled Tasks' folder
2007-07-28 04:00:30 D:\WINNT\tasks\Daily Backup.job
2007-07-29 21:18:50 D:\WINNT\tasks\Daily2.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-30 09:41:58
Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-30 9:45:19 - machine was rebooted
D:\ComboFix-quarantined-files.txt … 07-07-30 09:44
D:\ComboFix2.txt … 07-07-30 00:43
D:\ComboFix3.txt … 07-07-27 16:00

— E O F —