Spyware / Malware / Virus Removal

[Resolved] HELP, GOOGLE SEARCHES ARE REDIRECTED

4 min read

Looking for the outcome? Ask AI

MNBoatMan Topic Starter

Post #1August 28, 2008, 9:09 PM UTC

Sounds like I received the Stormy: Worm (Peacomm.D) from an e-card.exe file. The only symptom left is that every 2nd Google search is re-directed to a incorrect web site.

Here is my Hijack This Log 8/28/08

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:08:02 PM, on 8/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\Wave Systems Corp\Common\DataServer.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\cba\pds.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
C:\PROGRA~1\Symantec\SYMANT~1\NSCTOP.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft SQL Server\MSSQL.3\Reporting Services\ReportServer\bin\ReportingServicesService.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
C:\Program Files\VMware\VMware Converter\vmware-ufad.exe
C:\Program Files\VMware\VMware Server\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\ams_ii\hndlrsvc.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\system32\ams_ii\iao.exe
C:\WINDOWS\system32\cba\xfr.exe
C:\Program Files\Exchsrvr\bin\exmgmt.exe
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
C:\Program Files\TechSmith\SnagIt 7\SnagIt32.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\TechSmith\SnagIt 7\TSCHelp.exe
C:\TEMP\Jump Virus Fix\HiJackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\MI1933~1\Office12\OUTLOOK.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5061024
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mgcsql/esynergy/docs/bp.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5061024
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Medical Graphics Corporation
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = mgcisa:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.1.*;66.84.153.*;
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
O4 - Global Startup: SnagIt 7.lnk = C:\Program Files\TechSmith\SnagIt 7\SnagIt32.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://50.gmodules.com
O15 - Trusted Zone: http://53.gmodules.com
O15 - Trusted Zone: http://www.linkedin.com
O15 - Trusted Zone: http://*.mgc6
O15 - Trusted Zone: http://*.mgcmail2
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {0A2B8FD3-52A3-11D4-9E29-0001023AE3ED} (Crypto Class) - http://support.medgraphics.com/efrontoffic…marsFeather.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {210D0CBC-8B17-48D1-B294-1A338DD2EB3A} (VatCtrl Class) - http://70.88.61.157/VatDec.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {26774F3E-5F15-4883-8394-89146270A8C7} (SynergyOfficeAddin.Connect_Excel) - http://mgcsql/pilot/cab/SynergyOfficeAddin.CAB
O16 - DPF: {42D037E2-DECD-470C-B561-A18043C81B29} (Inter-Tel Unified Communicator Web Client) - http://66.84.153.196/UCROOT/WebCode/WebClient.cab
O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - https://www.microsoft.com/resources/virtual…iveXClient1.cab
O16 - DPF: {7C896371-4B7F-4B34-95B1-24851F5DED24} (Microsoft Virtual Server VMRC Control) - http://microsoft.granitepillar.com/vlatten…tiveXClient.cab
O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - https://transfers.ds.microsoft.com/FTM/Tran…ransferCtrl.cab
O16 - DPF: {8C41EB55-37B2-40CB-8942-F169CA06DB2F} (GPAuthorization Class) - http://microsoft.granitepillar.com/vlatten…d/gpconsole.cab
O16 - DPF: {A7B6FBFE-C894-4954-8377-D1CF19B4E07F} - http://uc.medgraphics.com/WCRS$/applets/OcxLink.cab
O16 - DPF: {B284ECAC-D46D-4354-B185-A5B06A01525D} (Inter-Tel Unified Communicator Administrator) - http://uc.medgraphics.com/UCROOT/WebCode/WebAdmin.cab
O16 - DPF: {BD324C84-E46E-11D3-83D0-00C04F4EB66B} (HTMLParser Class) - http://www.deltabike.com/inside/cab/ebcasp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://exact.webex.com/client/v_mywebex-t2…bex/ieatgpc.cab
O16 - DPF: {F3C7C5EE-8BBA-4B6E-8147-3B315A41B85B} - http://uc.medgraphics.com/clientinstall/install.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mgccorp.int
O17 - HKLM\Software\..\Telephony: DomainName = mgccorp.int
O17 - HKLM\System\CCS\Services\Tcpip\..\{7BFF05B4-3A40-4742-99D9-977FAD477CBB}: NameServer = 172.16.0.12
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mgccorp.int
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = mgccorp.int
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = mgccorp.int
O21 - SSODL: ChkActSh - {7371173B-E2BA-EA98-DEEE-04AD3E7AF03E} - C:\Program Files\eblnryc\ChkActSh.dll
O23 - Service: Broadcom ASF IP Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: Intel Alert Handler - LANDesk Software Ltd. - C:\WINDOWS\system32\ams_ii\hndlrsvc.exe
O23 - Service: Intel Alert Originator - LANDesk Software Ltd. - C:\WINDOWS\system32\ams_ii\iao.exe
O23 - Service: Intel File Transfer - LANDesk Software Ltd. - C:\WINDOWS\system32\cba\xfr.exe
O23 - Service: Intel PDS - LANDesk Software Ltd. - C:\WINDOWS\system32\cba\pds.exe
O23 - Service: Symantec System Center Discovery Service (NSCTOP) - Symantec Corporation - C:\PROGRA~1\Symantec\SYMANT~1\NSCTOP.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: NTRU Hybrid TSS v2.0.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
O23 - Service: VMware Converter Service (ufad-p2v) - VMware, Inc. - C:\Program Files\VMware\VMware Converter\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware Registration Service (vmserverdWin32) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

–
End of file - 13570 bytes

LDTate

Post #2August 30, 2008, 12:12 PM UTC

[external image: Posted Image]

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.

Please do not delete anything unless instructed to.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

MNBoatMan

Post #3September 1, 2008, 9:34 PM UTC

9/1/08 Completed the processes you recommended, here are the logs after re-booting.

Malwarebytes' Anti-Malware 1.25
Database version: 1103
Windows 5.1.2600 Service Pack 2

3:56:22 PM 9/1/2008
mbam-log-09-01-2008 (15-56-22).txt

Scan type: Quick Scan
Objects scanned: 87233
Time elapsed: 4 minute(s), 53 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 1
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\Program Files\eblnryc\ChkActSh.dll (Trojan.Unclassified) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{7371173b-e2ba-ea98-deee-04ad3e7af03e} (Trojan.Unclassified) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\chkactsh (Trojan.Unclassified) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\eblnryc\ChkActSh.dll (Trojan.Unclassified) -> Delete on reboot.
C:\WINDOWS\Downloaded Program Files\atmccli.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Downloaded Program Files\atmgr.exe (Trojan.Agent) -> Quarantined and deleted successfully.

9/1/08 Here is the new Hijackthis log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:23:40 PM, on 9/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\Wave Systems Corp\Common\DataServer.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\cba\pds.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
C:\PROGRA~1\Symantec\SYMANT~1\NSCTOP.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft SQL Server\MSSQL.3\Reporting Services\ReportServer\bin\ReportingServicesService.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
C:\Program Files\VMware\VMware Converter\vmware-ufad.exe
C:\Program Files\VMware\VMware Server\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\ams_ii\hndlrsvc.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\system32\ams_ii\iao.exe
C:\WINDOWS\system32\cba\xfr.exe
C:\Program Files\Exchsrvr\bin\exmgmt.exe
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\rdpclip.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
C:\Program Files\TechSmith\SnagIt 7\SnagIt32.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\TechSmith\SnagIt 7\TSCHelp.exe
C:\TEMP\Jump Virus Fix\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5061024
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mgcsql/esynergy/docs/bp.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5061024
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Medical Graphics Corporation
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = mgcisa:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.1.*;66.84.153.*;
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
O4 - Global Startup: SnagIt 7.lnk = C:\Program Files\TechSmith\SnagIt 7\SnagIt32.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://50.gmodules.com
O15 - Trusted Zone: http://53.gmodules.com
O15 - Trusted Zone: http://www.linkedin.com
O15 - Trusted Zone: http://*.mgc6
O15 - Trusted Zone: http://*.mgcmail2
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {0A2B8FD3-52A3-11D4-9E29-0001023AE3ED} (Crypto Class) - http://support.medgraphics.com/efrontoffic…marsFeather.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {210D0CBC-8B17-48D1-B294-1A338DD2EB3A} (VatCtrl Class) - http://70.88.61.157/VatDec.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {26774F3E-5F15-4883-8394-89146270A8C7} (SynergyOfficeAddin.Connect_Excel) - http://mgcsql/pilot/cab/SynergyOfficeAddin.CAB
O16 - DPF: {42D037E2-DECD-470C-B561-A18043C81B29} (Inter-Tel Unified Communicator Web Client) - http://66.84.153.196/UCROOT/WebCode/WebClient.cab
O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - https://www.microsoft.com/resources/virtual…iveXClient1.cab
O16 - DPF: {7C896371-4B7F-4B34-95B1-24851F5DED24} (Microsoft Virtual Server VMRC Control) - http://microsoft.granitepillar.com/vlatten…tiveXClient.cab
O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - https://transfers.ds.microsoft.com/FTM/Tran…ransferCtrl.cab
O16 - DPF: {8C41EB55-37B2-40CB-8942-F169CA06DB2F} (GPAuthorization Class) - http://microsoft.granitepillar.com/vlatten…d/gpconsole.cab
O16 - DPF: {A7B6FBFE-C894-4954-8377-D1CF19B4E07F} - http://uc.medgraphics.com/WCRS$/applets/OcxLink.cab
O16 - DPF: {B284ECAC-D46D-4354-B185-A5B06A01525D} (Inter-Tel Unified Communicator Administrator) - http://uc.medgraphics.com/UCROOT/WebCode/WebAdmin.cab
O16 - DPF: {BD324C84-E46E-11D3-83D0-00C04F4EB66B} (HTMLParser Class) - http://www.deltabike.com/inside/cab/ebcasp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://exact.webex.com/client/v_mywebex-t2…bex/ieatgpc.cab
O16 - DPF: {F3C7C5EE-8BBA-4B6E-8147-3B315A41B85B} - http://uc.medgraphics.com/clientinstall/install.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mgccorp.int
O17 - HKLM\Software\..\Telephony: DomainName = mgccorp.int
O17 - HKLM\System\CCS\Services\Tcpip\..\{7BFF05B4-3A40-4742-99D9-977FAD477CBB}: NameServer = 172.16.0.12
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mgccorp.int
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = mgccorp.int
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = mgccorp.int
O23 - Service: Broadcom ASF IP Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: Intel Alert Handler - LANDesk Software Ltd. - C:\WINDOWS\system32\ams_ii\hndlrsvc.exe
O23 - Service: Intel Alert Originator - LANDesk Software Ltd. - C:\WINDOWS\system32\ams_ii\iao.exe
O23 - Service: Intel File Transfer - LANDesk Software Ltd. - C:\WINDOWS\system32\cba\xfr.exe
O23 - Service: Intel PDS - LANDesk Software Ltd. - C:\WINDOWS\system32\cba\pds.exe
O23 - Service: Symantec System Center Discovery Service (NSCTOP) - Symantec Corporation - C:\PROGRA~1\Symantec\SYMANT~1\NSCTOP.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: NTRU Hybrid TSS v2.0.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
O23 - Service: VMware Converter Service (ufad-p2v) - VMware, Inc. - C:\Program Files\VMware\VMware Converter\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware Registration Service (vmserverdWin32) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

–
End of file - 13407 bytes

LDTate

Post #4September 2, 2008, 1:19 AM UTC

Download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–

Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
Please do not re-connect your machine back to the Internet until Combofix has completely finished.

——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Give it atleast 20-30 minutes to finish if needed.

MNBoatMan

Post #5September 2, 2008, 8:32 PM UTC

I completed running the ComboFix application and have posted the log below. I can not get HijackThis to run since using ComboFix so I have uninstalled HijackThis, re-booted and tried to re-run the HijackThis install. The installation fails at the start with the following error message: "The application failed to initialize properly (0xc000007b). Click on OK to terminate the application".

ComboFix 08-09-01.01 - Randy-s 2008-09-02 9:35:17.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1305 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Randy-S.MGCCORP\Application Data\macromedia\Flash Player\#SharedObjects\UDFZLMTU\interclick.com
C:\Documents and Settings\Randy-S.MGCCORP\Application Data\macromedia\Flash Player\#SharedObjects\UDFZLMTU\interclick.com\ud.sol
C:\Documents and Settings\Randy-S.MGCCORP\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Randy-S.MGCCORP\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\WINDOWS\Downloaded Program Files\Inter-Tel
C:\WINDOWS\Downloaded Program Files\Inter-Tel\error.xml
C:\WINDOWS\Downloaded Program Files\Inter-Tel\IEWebClient.dll
C:\WINDOWS\Downloaded Program Files\Inter-Tel\TrayClient.exe
C:\WINDOWS\Downloaded Program Files\Inter-Tel\TrayClient.exe.manifest
C:\WINDOWS\Downloaded Program Files\Inter-Tel\UninstallUC.exe
C:\WINDOWS\Downloaded Program Files\Inter-Tel\WebAdmin.ocx
C:\WINDOWS\Downloaded Program Files\Inter-Tel\xConfig.xml
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\mdm.exe
C:\WINDOWS\system32\MSINET.oca

.
((((((((((((((((((((((((( Files Created from 2008-08-02 to 2008-09-02 )))))))))))))))))))))))))))))))
.

2008-09-01 15:32 . 2008-09-01 15:32 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-09-01 15:32 . 2008-09-01 15:32 d——– C:\Documents and Settings\Randy-S.MGCCORP\Application Data\Malwarebytes
2008-09-01 15:32 . 2008-09-01 15:32 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-01 15:32 . 2008-08-17 15:01 38,472 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-01 15:32 . 2008-08-17 15:01 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-08-29 15:36 . 2008-08-29 15:36 0 –a—— C:\WINDOWS\SOP.trk
2008-08-29 15:21 . 2008-08-29 15:21 0 –a—— C:\WINDOWS\INV.trk
2008-08-22 15:35 . 2008-08-22 15:35 d–h-c— C:\Documents and Settings\All Users\Application Data\{C236EA39-E76E-497D-8522-DE18F9838F13}
2008-08-22 15:30 . 2008-08-22 15:30 d——– C:\Program Files\InstallAware
2008-08-22 05:34 . 2008-08-22 05:34 0 –a—— C:\WINDOWS\sysman.trk
2008-08-21 16:15 . 2008-08-21 16:15 d——– C:\TEMP\VMWare
2008-08-19 18:01 . 2007-08-01 22:47 102,664 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2008-08-19 16:53 . 2008-08-19 18:08 d——– C:\Documents and Settings\Randy-S.MGCCORP\.housecall6.6
2008-08-14 16:18 . 2008-08-14 16:18 d——– C:\Program Files\Spybot - Search & Destroy
2008-08-14 15:00 . 2008-08-28 15:51 d——– C:\fixwareout
2008-08-14 14:53 . 2008-09-02 09:28 d——– C:\TEMP\Jump Virus Fix
2008-08-14 10:27 . 2008-09-01 15:57 d——– C:\Program Files\eblnryc
2008-08-14 10:27 . 2008-08-19 10:03 d——– C:\Documents and Settings\All Users\Application Data\vebwhklq
2008-08-13 18:44 . 2008-05-01 09:30 331,776 ——— C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-11 16:17 . 2008-08-11 16:17 d——– C:\Program Files\Common Files\Merge Modules
2008-08-11 15:44 . 2008-08-11 15:44 d——– C:\Program Files\SQLXML 4.0
2008-08-11 08:41 . 2008-08-11 08:41 d——– C:\Program Files\Microsoft Office Outlook Connector
2008-08-11 08:40 . 2008-08-11 08:40 d——– C:\Program Files\MSECache
2008-08-08 16:02 . 2008-08-08 16:56 d——– C:\Program Files\SQL Server DBA Dashboard
2008-08-08 15:34 . 2008-08-08 15:34 d——– C:\PortQryV2
2008-08-08 09:42 . 2007-12-20 04:01 d——– C:\Documents and Settings\RANDYS03251\ASPNET\Application Data\Wave Systems Corp
2008-08-08 09:42 . 2008-08-08 09:42 d——– C:\Documents and Settings\RANDYS03251\ASPNET
2008-08-08 09:42 . 2008-08-08 09:42 d——– C:\Documents and Settings\RANDYS03251
2008-08-05 16:07 . 2006-10-04 09:06 1,197,294 ——— C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-08-05 16:07 . 2006-10-04 09:06 764,868 ——— C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-08-05 16:07 . 2006-10-04 09:06 217,118 ——— C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-08-05 16:06 . 2008-08-05 16:06 d——– C:\Program Files\Windows Media Connect 2
2008-08-05 16:05 . 2008-08-05 16:06 d——– C:\WINDOWS\system32\drivers\UMDF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-02 14:50 ——— d—–w C:\WINDOWS\system32\config\systemprofile\Application Data\VMware
2008-09-02 14:50 ——— d—–w C:\Documents and Settings\LocalService\Application Data\VMware
2008-09-02 14:49 ——— d—–w C:\Documents and Settings\All Users\Application Data\VMware
2008-09-02 14:38 ——— d—–w C:\Program Files\Symantec AntiVirus
2008-08-28 20:18 ——— d—–w C:\Documents and Settings\Randy-S.MGCCORP\Application Data\Wave Systems Corp
2008-08-21 19:40 ——— d—–w C:\Documents and Settings\Randy-S.MGCCORP\Application Data\VMware
2008-08-20 13:09 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Wave Systems Corp
2008-08-19 14:06 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-08-18 15:45 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-18 15:43 ——— d—–w C:\Program Files\Microsoft Visual Studio 8
2008-08-15 13:03 ——— d—–w C:\Program Files\Google
2008-08-14 21:25 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-14 20:24 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-11 20:47 ——— d—–w C:\Program Files\Microsoft SQL Server
2008-08-07 15:40 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-08-03 08:01 ——— d—–w C:\Program Files\Microsoft ActiveSync
2002-08-02 12:00 12,348 —-a-w C:\Program Files\viewsonicinstruct_xp.pdf
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 13:39 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-10-04 13:42 48752]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-11-15 14:28 85744]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-03-12 10:04 7204864]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 18:32 221184]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2006-04-26 07:39 143360]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 05:20 122940]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
EMBASSY Trust Suite Secure Update.lnk - C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe [2006-01-30 17:11:48 192512]
SnagIt 7.lnk - C:\Program Files\TechSmith\SnagIt 7\SnagIt32.exe [2005-06-17 08:24:00 3719168]
Windows Desktop Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2006-10-19 15:55:04 110080]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-10-19 15:53 293888]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wxvault.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.rhetorex"= RHETOREX.ACM

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Randy-S.MGCCORP^Start Menu^Programs^Startup^Launch SymmTime.exe.lnk]
path=C:\Documents and Settings\Randy-S.MGCCORP\Start Menu\Programs\Startup\Launch SymmTime.exe.lnk
backup=C:\WINDOWS\pss\Launch SymmTime.exe.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANT Agent]
–a—— 2008-04-04 10:53 8211544 C:\Garmin\ANT Agent\ANT Agent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BuildBU]
–a—— 2004-02-19 06:23 61440 c:\dell\bldbubg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Document Manager]
–a—— 2006-05-16 12:35 102400 C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
——— 2005-12-09 20:29 49152 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
–a—— 2006-08-30 11:48 28672 c:\dell\E-Center\EULAl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EFI Job Monitor]
–a—— 2006-07-18 18:05 3067904 C:\WINDOWS\system32\spool\drivers\w32x86\3\efjm.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
–a—— 2006-11-13 13:39 1289000 C:\Program Files\Microsoft ActiveSync\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
–a—— 2004-07-27 16:50 221184 C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
–a—— 2004-07-27 16:50 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
–a—— 2005-06-08 15:44 196608 C:\Program Files\Logitech\Video\ManifestEngine.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
–a—— 2005-06-08 16:24 458752 C:\Program Files\Logitech\Video\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
–a—— 2005-06-08 16:14 217088 C:\Program Files\Logitech\Video\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder]
-ra—— 2006-01-30 11:00 98304 C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2007-02-16 10:54 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2005-11-10 13:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
–a—— 2006-03-20 15:00 282624 C:\WINDOWS\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 PBADRV;PBADRV;C:\WINDOWS\system32\drivers\pbadrv.sys [2005-12-09 15:35]
R2 ASFIPmon;Broadcom ASF IP Monitor;C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe [2006-03-17 17:25]
R2 MsDtsServer;SQL Server Integration Services;C:\Program Files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe [2005-10-14 03:45]
R2 MSExchangeMGMT;Microsoft Exchange Management;C:\Program Files\Exchsrvr\bin\exmgmt.exe [2003-06-24 02:00]
R2 ReportServer;SQL Server Reporting Services (MSSQLSERVER);C:\Program Files\Microsoft SQL Server\MSSQL.3\Reporting Services\ReportServer\bin\ReportingServicesService.exe [2005-10-14 03:44]
R2 SSService;Visual SourceSafe LAN Service;C:\Program Files\Microsoft Visual SourceSafe\SSService.EXE [2007-11-21 10:12]
R2 ufad-p2v;VMware Converter Service;C:\Program Files\VMware\VMware Converter\vmware-ufad.exe [2007-11-01 17:20]
R2 vmserverdWin32;VMware Registration Service;C:\Program Files\VMware\VMware Server\vmserverdWin32.exe [2007-04-12 20:05]
R2 vstor2-p2v30;Vstor2 P2V30 Virtual Storage Driver;C:\Program Files\VMware\VMware Converter\vstor2-p2v30.sys [2007-11-01 17:18]
S3 DSI_SiUSBXp_3_1;DSI_SiUSBXp_3_1;C:\WINDOWS\system32\drivers\DSI_SiUSBXp_3_1.sys [2007-09-06 15:53]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2006-12-02 06:17]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
HKCU-Run-swg - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
MSConfigStartUp-McafWelcome - c:\PROGRA~1\mcafee.com\agent\mcwelcom.exe
MSConfigStartUp-MCAgentExe - c:\PROGRA~1\mcafee.com\agent\mcagent.exe
MSConfigStartUp-MCUpdateExe - c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
MSConfigStartUp-MPFExe - C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
MSConfigStartUp-MSKAGENTEXE - C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
MSConfigStartUp-MSKDetectorExe - C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe
MSConfigStartUp-OASClnt - C:\Program Files\McAfee.com\VSO\oasclnt.exe
MSConfigStartUp-SplitScreen - C:\Program Files\SplitView 2008\SplitScr.exe
MSConfigStartUp-VirusScan Online - c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
MSConfigStartUp-VSOCheckTask - C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe

.
——- Supplementary Scan ——-
.
R0 -: HKCU-Main,Start Page = hxxp://mgcsql/esynergy/docs/bp.asp
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
R1 -: HKCU-Internet Settings,ProxyServer = mgcisa:8080
R1 -: HKCU-Internet Settings,ProxyOverride = 192.168.1.*;66.84.153.*;
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/keyword/%s
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O17 -: HKLM\CCS\Interface\{7BFF05B4-3A40-4742-99D9-977FAD477CBB}: NameServer = 172.16.0.12

O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

O16 -: {0A2B8FD3-52A3-11D4-9E29-0001023AE3ED} - hxxp://support.medgraphics.com/efrontoffice/Downloads/ImarsFeather.cab
C:\WINDOWS\Downloaded Program Files\ImarsFeather.dll

O16 -: {210D0CBC-8B17-48D1-B294-1A338DD2EB3A} - hxxp://70.88.61.157/VatDec.cab
C:\WINDOWS\Downloaded Program Files\VATDecoder.dll

O16 -: {26774F3E-5F15-4883-8394-89146270A8C7} - hxxp://mgcsql/pilot/cab/SynergyOfficeAddin.CAB
C:\WINDOWS\Downloaded Program Files\SynergyOfficeAddin.INF
C:\EXACT\MAX\MFW2\eSynInt.dll
C:\WINDOWS\system32\TABCTL32.OCX
C:\WINDOWS\system32\comctl32.ocx
C:\WINDOWS\system32\MSCAL.OCX
C:\WINDOWS\Downloaded Program Files\MSFilter.dll
C:\WINDOWS\Downloaded Program Files\SynergyOfficeAddin.dll

O16 -: {42D037E2-DECD-470C-B561-A18043C81B29} - hxxp://66.84.153.196/UCROOT/WebCode/WebClient.cab
C:\WINDOWS\Downloaded Program Files\IEWebClient.inf

O16 -: {7C896371-4B7F-4B34-95B1-24851F5DED24} - hxxp://microsoft.granitepillar.com/vlattend/shared/MSVMRCActiveXClient.cab
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\VMRCActiveXClient.inf
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\VMKeyboardHook.dll
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\VMRCActiveXClient.dll

O16 -: {8C41EB55-37B2-40CB-8942-F169CA06DB2F} - hxxp://microsoft.granitepillar.com/vlattend/shared/gpconsole.cab
C:\WINDOWS\Downloaded Program Files\gpconsole.inf
C:\WINDOWS\Downloaded Program Files\gpconsole.ocx

O16 -: {A7B6FBFE-C894-4954-8377-D1CF19B4E07F} - hxxp://uc.medgraphics.com/WCRS$/applets/OcxLink.cab
C:\WINDOWS\Downloaded Program Files\wapplink.inf
C:\WINDOWS\system32\mfc42.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\olepro32.dll
C:\WINDOWS\Downloaded Program Files\wapplink.dll
C:\WINDOWS\Downloaded Program Files\wapplink.ocx

O16 -: {B284ECAC-D46D-4354-B185-A5B06A01525D} - hxxp://uc.medgraphics.com/UCROOT/WebCode/WebAdmin.cab
C:\WINDOWS\Downloaded Program Files\WebAdmin.inf

O16 -: {BD324C84-E46E-11D3-83D0-00C04F4EB66B} - hxxp://www.deltabike.com/inside/cab/ebcasp.cab
C:\EXACT\MAX\MFW2\ebcasp.dll

O16 -: {F3C7C5EE-8BBA-4B6E-8147-3B315A41B85B} - hxxp://uc.medgraphics.com/clientinstall/install.cab
C:\WINDOWS\Downloaded Program Files\Setup.inf
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-02 09:50:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\msftesql]
"ImagePath"="\"C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe\" -s:MSSQL.2 -f:MSSQLSERVER"
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Wave Systems Corp\common\DataServer.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\CBA\PDS.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\OLAP\bin\msmdsrv.exe
C:\PROGRA~1\Symantec\SYMANT~1\NscTop.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
C:\Program Files\VMware\VMware Server\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\searchindexer.exe
C:\WINDOWS\system32\AMS_II\HNDLRSVC.EXE
C:\WINDOWS\system32\MSGSYS.EXE
C:\WINDOWS\system32\AMS_II\IAO.EXE
C:\WINDOWS\system32\CBA\XFR.EXE
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\TechSmith\SnagIt 7\TscHelp.exe
.
**************************************************************************
.
Completion time: 2008-09-02 9:53:34 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-02 14:53:31

Pre-Run: 32,765,919,232 bytes free
Post-Run: 32,674,234,368 bytes free

287 — E O F — 2008-08-19 08:00:24

LDTate

Post #6September 2, 2008, 9:04 PM UTC

Do you know what these are?
C:\TEMP\Jump Virus Fix
C:\Program Files\eblnryc
C:\Documents and Settings\All Users\Application Data\vebwhklq

Open notepad and copy/paste the text in the Codebox below into it:

File::
C:\WINDOWS\SOP.trk
C:\WINDOWS\INV.trk
C:\WINDOWS\sysman.trk

Save this as Save this as "CFScript"

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe then post the results log

Try downloading HJT again.

Please delete any HijackThis Folders and Files you have now.

Download from here HijackThis.

Click the "Save" button.

Please put your HijackThis in it's own folder, (I create a new folder in C:\ named HJT).
You can do a Right Click on any open area on the desktop, New> Folder, then rename the folder HJT.

Open HijackThis and select: Do a system scan and save a log file.

When the scan is finished, Click Edit> Select All> Edit> Copy> and paste its contents here [Add Reply].

MNBoatMan

Post #7September 3, 2008, 3:43 PM UTC

I was only able to get ComboFix to run in safe mode. The log is listed below. Uninstalling then re-installing Hijackthis will allow the program to run once. After running the one time, any attempt to run Hijackthis results in a eror, "the application failed to initialize properly (0xc000007b)". The Hijackthis log is listed below.

Do you know what these are?
C:\TEMP\Jump Virus Fix = A directory I created to keep track of this issue, I made up the name Jump Virus.
C:\Program Files\eblnryc = I do not know what this is.
C:\Documents and Settings\All Users\Application Data\vebwhklq = I do not know what this is.

ComboFix 08-09-01.05 - Administrator 2008-09-03 8:56:36.2 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1706 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-08-03 to 2008-09-03 )))))))))))))))))))))))))))))))
.

2008-09-02 15:21 . 2008-09-02 15:21 d——– C:\Program Files\Trend Micro
2008-09-02 15:05 . 2008-05-29 09:09 38,248 –a—— C:\WINDOWS\system32\drivers\WGX.SYS
2008-09-02 10:44 . 2008-05-29 09:09 91,008 –a—— C:\WINDOWS\system32\drivers\SysPlant.sys
2008-09-02 10:44 . 2008-09-02 10:44 10,652 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-09-02 10:44 . 2008-09-02 10:44 806 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-09-01 15:32 . 2008-09-01 15:32 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-09-01 15:32 . 2008-09-01 15:32 d——– C:\Documents and Settings\Randy-S.MGCCORP\Application Data\Malwarebytes
2008-09-01 15:32 . 2008-09-01 15:32 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-01 15:32 . 2008-08-17 15:01 38,472 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-01 15:32 . 2008-08-17 15:01 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-08-22 15:35 . 2008-08-22 15:35 d–h-c— C:\Documents and Settings\All Users\Application Data\{C236EA39-E76E-497D-8522-DE18F9838F13}
2008-08-22 15:30 . 2008-08-22 15:30 d——– C:\Program Files\InstallAware
2008-08-21 16:15 . 2008-08-21 16:15 d——– C:\TEMP\VMWare
2008-08-19 18:01 . 2007-08-01 22:47 102,664 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2008-08-19 16:53 . 2008-08-19 18:08 d——– C:\Documents and Settings\Randy-S.MGCCORP\.housecall6.6
2008-08-14 16:18 . 2008-08-14 16:18 d——– C:\Program Files\Spybot - Search & Destroy
2008-08-14 15:00 . 2008-08-28 15:51 d——– C:\fixwareout
2008-08-14 14:53 . 2008-09-03 08:41 d——– C:\TEMP\Jump Virus Fix
2008-08-14 10:27 . 2008-09-01 15:57 d——– C:\Program Files\eblnryc
2008-08-14 10:27 . 2008-08-19 10:03 d——– C:\Documents and Settings\All Users\Application Data\vebwhklq
2008-08-13 18:44 . 2008-05-01 09:30 331,776 ——— C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-11 16:17 . 2008-08-11 16:17 d——– C:\Program Files\Common Files\Merge Modules
2008-08-11 15:44 . 2008-08-11 15:44 d——– C:\Program Files\SQLXML 4.0
2008-08-11 08:41 . 2008-08-11 08:41 d——– C:\Program Files\Microsoft Office Outlook Connector
2008-08-11 08:40 . 2008-08-11 08:40 d——– C:\Program Files\MSECache
2008-08-08 16:02 . 2008-08-08 16:56 d——– C:\Program Files\SQL Server DBA Dashboard
2008-08-08 15:34 . 2008-08-08 15:34 d——– C:\PortQryV2
2008-08-08 09:42 . 2007-12-20 04:01 d——– C:\Documents and Settings\RANDYS03251\ASPNET\Application Data\Wave Systems Corp
2008-08-08 09:42 . 2008-08-08 09:42 d——– C:\Documents and Settings\RANDYS03251\ASPNET
2008-08-08 09:42 . 2008-08-08 09:42 d——– C:\Documents and Settings\RANDYS03251
2008-08-05 16:07 . 2006-10-04 09:06 1,197,294 ——— C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-08-05 16:07 . 2006-10-04 09:06 764,868 ——— C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-08-05 16:07 . 2006-10-04 09:06 217,118 ——— C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-08-05 16:06 . 2008-08-05 16:06 d——– C:\Program Files\Windows Media Connect 2
2008-08-05 16:05 . 2008-08-05 16:06 d——– C:\WINDOWS\system32\drivers\UMDF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-03 14:02 ——— d—–w C:\WINDOWS\system32\config\systemprofile\Application Data\VMware
2008-09-03 14:00 ——— d—–w C:\Documents and Settings\All Users\Application Data\VMware
2008-09-03 13:12 ——— d—–w C:\Documents and Settings\Randy-S.MGCCORP\Application Data\Wave Systems Corp
2008-09-02 15:48 706 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-09-02 15:48 23,888 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-09-02 15:48 10,537 —-a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-09-02 15:48 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-09-02 15:47 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-09-02 15:46 50,536 —-a-w C:\WINDOWS\system32\drivers\WpsHelper.sys
2008-09-02 15:44 136,496 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-09-02 15:44 ——— d—–w C:\Program Files\Symantec
2008-09-02 15:28 ——— d—–w C:\Program Files\Symantec AntiVirus
2008-08-21 19:40 ——— d—–w C:\Documents and Settings\Randy-S.MGCCORP\Application Data\VMware
2008-08-20 13:09 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Wave Systems Corp
2008-08-19 14:06 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-08-18 15:45 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-18 15:43 ——— d—–w C:\Program Files\Microsoft Visual Studio 8
2008-08-15 13:03 ——— d—–w C:\Program Files\Google
2008-08-14 21:25 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-14 20:24 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-11 20:47 ——— d—–w C:\Program Files\Microsoft SQL Server
2008-08-07 15:40 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-08-03 08:01 ——— d—–w C:\Program Files\Microsoft ActiveSync
2002-08-02 12:00 12,348 —-a-w C:\Program Files\viewsonicinstruct_xp.pdf
.

((((((((((((((((((((((((((((( snapshot@2008-09-02_ 9.53.17.89 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-09-02 15:44:48 21,446 —-a-r C:\WINDOWS\Installer\{FB8A4E30-9915-4814-ADF9-42E00D9FDC3D}\ARPPRODUCTICON.exe
- 2003-03-19 02:05:50 89,088 —-a-w C:\WINDOWS\system32\atl71.dll
+ 2008-05-29 14:09:24 89,088 —-a-w C:\WINDOWS\system32\atl71.dll
- 2006-09-01 20:41:30 509,952 —-a-w C:\WINDOWS\system32\CapiCom.dll
+ 2007-08-12 01:05:27 511,328 —-a-w C:\WINDOWS\system32\CapiCom.dll
- 2005-11-15 19:29:28 34,600 —-a-w C:\WINDOWS\system32\cba.dll
+ 2008-05-29 14:09:24 34,288 —-a-w C:\WINDOWS\system32\cba.dll
- 2006-11-21 22:47:51 16,384 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-09-02 15:49:28 16,384 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2006-11-21 22:47:51 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-09-02 15:49:28 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2006-11-21 22:47:51 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-09-02 15:49:28 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-05-29 14:09:18 279,088 —-a-w C:\WINDOWS\system32\drivers\srtsp.sys
+ 2008-05-29 14:09:18 317,616 —-a-w C:\WINDOWS\system32\drivers\srtspl.sys
+ 2008-05-29 14:09:18 43,696 —-a-w C:\WINDOWS\system32\drivers\srtspx.sys
- 2005-10-19 23:38:40 12,944 —-a-w C:\WINDOWS\system32\drivers\symdns.sys
+ 2008-05-29 14:08:52 12,984 —-a-w C:\WINDOWS\system32\drivers\symdns.sys
- 2005-10-19 23:38:46 109,200 —-a-w C:\WINDOWS\system32\drivers\symfw.sys
+ 2008-05-29 14:08:52 145,976 —-a-w C:\WINDOWS\system32\drivers\symfw.sys
- 2005-10-19 23:38:54 31,888 —-a-w C:\WINDOWS\system32\drivers\symids.sys
+ 2008-05-29 14:08:52 40,120 —-a-w C:\WINDOWS\system32\drivers\symids.sys
- 2005-10-19 23:38:50 28,304 —-a-w C:\WINDOWS\system32\drivers\symndis.sys
+ 2008-05-29 14:08:52 35,256 —-a-w C:\WINDOWS\system32\drivers\symndis.sys
+ 2008-05-29 14:08:52 38,200 —-a-w C:\WINDOWS\system32\drivers\symndisv.sys
- 2005-10-19 23:38:58 24,720 —-a-w C:\WINDOWS\system32\drivers\symredrv.sys
+ 2008-05-29 14:08:52 27,576 —-a-w C:\WINDOWS\system32\drivers\symredrv.sys
- 2005-10-19 23:39:04 195,728 —-a-w C:\WINDOWS\system32\drivers\symtdi.sys
+ 2008-05-29 14:08:52 191,544 —-a-w C:\WINDOWS\system32\drivers\symtdi.sys
+ 2008-05-29 14:09:12 49,024 —-a-w C:\WINDOWS\system32\drivers\teefer2.sys
+ 2008-05-29 14:09:24 40,832 —-a-w C:\WINDOWS\system32\drivers\WPSDRVnt.sys
+ 2008-05-29 14:09:26 48,000 —-a-w C:\WINDOWS\system32\FwsVpn.dll
- 2008-09-02 14:49:21 252,797 —-a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
+ 2008-09-03 14:04:22 252,793 —-a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
- 2003-03-19 04:20:00 1,060,864 —-a-w C:\WINDOWS\system32\MFC71.dll
+ 2007-03-22 01:39:00 1,060,864 —-a-w C:\WINDOWS\system32\MFC71.DLL
- 2005-11-15 19:29:30 46,896 —-a-w C:\WINDOWS\system32\msgsys.dll
+ 2008-05-29 14:09:26 46,584 —-a-w C:\WINDOWS\system32\msgsys.dll
- 2003-03-19 03:14:52 499,712 —-a-w C:\WINDOWS\system32\msvcp71.dll
+ 2007-03-22 01:33:00 503,808 —-a-w C:\WINDOWS\system32\MSVCP71.DLL
- 2003-02-21 11:42:22 348,160 —-a-w C:\WINDOWS\system32\msvcr71.dll
+ 2007-03-22 01:33:00 348,160 —-a-w C:\WINDOWS\system32\MSVCR71.DLL
- 2005-11-15 19:29:30 83,752 —-a-w C:\WINDOWS\system32\nts.dll
+ 2008-05-29 14:09:26 91,632 —-a-w C:\WINDOWS\system32\nts.dll
- 2005-11-15 19:29:32 83,752 —-a-w C:\WINDOWS\system32\pds.dll
+ 2008-05-29 14:09:26 83,440 —-a-w C:\WINDOWS\system32\pds.dll
- 2008-08-21 14:00:38 544,816 —-a-w C:\WINDOWS\system32\pscl.dll
+ 2008-09-02 20:34:55 544,816 —-a-w C:\WINDOWS\system32\pscl.dll
- 2008-08-21 14:00:38 254,002 —-a-w C:\WINDOWS\system32\pscore.dll
+ 2008-09-02 20:34:55 254,002 —-a-w C:\WINDOWS\system32\pscore.dll
- 2005-09-17 06:20:06 87,768 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
+ 2008-09-02 15:44:14 60,808 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
- 2005-10-19 23:39:10 534,160 —-a-w C:\WINDOWS\system32\SymNeti.dll
+ 2008-05-29 14:09:24 624,784 —-a-w C:\WINDOWS\system32\SymNeti.dll
- 2005-10-19 23:39:08 161,424 —-a-w C:\WINDOWS\system32\SymRedir.dll
+ 2008-05-29 14:09:24 242,320 —-a-w C:\WINDOWS\system32\SymRedir.dll
+ 2008-05-29 14:09:28 107,904 —-a-w C:\WINDOWS\system32\SymVPN.dll
+ 2008-05-29 14:09:28 329,088 —-a-w C:\WINDOWS\system32\sysfer.dll
+ 2008-09-03 14:01:30 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_45c.dat
+ 2008-09-03 14:00:23 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_7cc.dat
+ 2008-09-03 14:02:40 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_f44.dat
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-03-12 7204864]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 221184]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2006-04-26 143360]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 282624]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-05-29 115560]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
EMBASSY Trust Suite Secure Update.lnk - C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe [2006-01-30 192512]
SnagIt 7.lnk - C:\Program Files\TechSmith\SnagIt 7\SnagIt32.exe [2005-06-17 3719168]
Windows Desktop Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2006-10-19 110080]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-10-19 293888]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wxvault.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.rhetorex"= RHETOREX.ACM

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antvirus]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Randy-S.MGCCORP^Start Menu^Programs^Startup^Launch SymmTime.exe.lnk]
path=C:\Documents and Settings\Randy-S.MGCCORP\Start Menu\Programs\Startup\Launch SymmTime.exe.lnk
backup=C:\WINDOWS\pss\Launch SymmTime.exe.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANT Agent]
–a—— 2008-04-04 10:53 8211544 C:\Garmin\ANT Agent\ANT Agent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BuildBU]
–a—— 2004-02-19 06:23 61440 c:\dell\bldbubg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Document Manager]
–a—— 2006-05-16 12:35 102400 C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
——— 2005-12-09 20:29 49152 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
–a—— 2006-08-30 11:48 28672 c:\dell\E-Center\EULAl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EFI Job Monitor]
–a—— 2006-07-18 18:05 3067904 C:\WINDOWS\system32\spool\drivers\w32x86\3\efjm.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
–a—— 2006-11-13 13:39 1289000 C:\Program Files\Microsoft ActiveSync\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
–a—— 2004-07-27 16:50 221184 C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
–a—— 2004-07-27 16:50 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
–a—— 2005-06-08 15:44 196608 C:\Program Files\Logitech\Video\ManifestEngine.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
–a—— 2005-06-08 16:24 458752 C:\Program Files\Logitech\Video\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
–a—— 2005-06-08 16:14 217088 C:\Program Files\Logitech\Video\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder]
-ra—— 2006-01-30 11:00 98304 C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2007-02-16 10:54 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2005-11-10 13:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
–a—— 2006-03-20 15:00 282624 C:\WINDOWS\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 PBADRV;PBADRV;C:\WINDOWS\system32\drivers\pbadrv.sys [2005-12-09 18816]
R2 ASFIPmon;Broadcom ASF IP Monitor;C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe [2006-03-17 65536]
R2 MsDtsServer;SQL Server Integration Services;C:\Program Files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe [2005-10-14 199384]
R2 MSExchangeMGMT;Microsoft Exchange Management;C:\Program Files\Exchsrvr\bin\exmgmt.exe [2003-06-24 3117568]
R2 ReportServer;SQL Server Reporting Services (MSSQLSERVER);C:\Program Files\Microsoft SQL Server\MSSQL.3\Reporting Services\ReportServer\bin\ReportingServicesService.exe [2005-10-14 14552]
R2 SSService;Visual SourceSafe LAN Service;C:\Program Files\Microsoft Visual SourceSafe\SSService.EXE [2007-11-21 329728]
R2 ufad-p2v;VMware Converter Service;C:\Program Files\VMware\VMware Converter\vmware-ufad.exe [2007-11-01 176128]
R2 vmserverdWin32;VMware Registration Service;C:\Program Files\VMware\VMware Server\vmserverdWin32.exe [2007-04-12 1646685]
R2 vstor2-p2v30;Vstor2 P2V30 Virtual Storage Driver;C:\Program Files\VMware\VMware Converter\vstor2-p2v30.sys [2007-11-01 19248]
R2 WGX;Extend WG Protocol Driver;C:\WINDOWS\system32\Drivers\WGX.SYS [2008-05-29 38248]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-09-02 23888]
S3 DSI_SiUSBXp_3_1;DSI_SiUSBXp_3_1;C:\WINDOWS\system32\drivers\DSI_SiUSBXp_3_1.sys [2007-09-06 14848]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2006-12-02 2805000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
Notify-NavLogon - (no file)

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-03 09:03:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\msftesql]
"ImagePath"="\"C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe\" -s:MSSQL.2 -f:MSSQLSERVER"

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\vsdatant]
"ImagePath"="a"
.
———————— Other Running Processes ————————
.
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Wave Systems Corp\common\DataServer.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\OLAP\bin\msmdsrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
C:\Program Files\VMware\VMware Server\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\searchindexer.exe
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\TechSmith\SnagIt 7\TscHelp.exe
.
**************************************************************************
.
Completion time: 2008-09-03 9:07:35 - machine was rebooted [Randy-S]
ComboFix-quarantined-files.txt 2008-09-03 14:07:28
ComboFix2.txt 2008-09-02 14:53:35

Pre-Run: 32,333,176,832 bytes free
Post-Run: 32,361,631,744 bytes free

292 — E O F — 2008-08-19 08:00:24

Logfile of HijackThis v1.99.1
Scan saved at 10:34, on 2008-09-03
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\Wave Systems Corp\Common\DataServer.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft SQL Server\MSSQL.3\Reporting Services\ReportServer\bin\ReportingServicesService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
C:\Program Files\VMware\VMware Converter\vmware-ufad.exe
C:\Program Files\VMware\VMware Server\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Exchsrvr\bin\exmgmt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
C:\Program Files\TechSmith\SnagIt 7\SnagIt32.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\TechSmith\SnagIt 7\TSCHelp.exe
C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mgcsql/esynergy/docs/bp.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5061024
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = mgcisa:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.1.*;66.84.153.*;
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
O4 - Global Startup: SnagIt 7.lnk = C:\Program Files\TechSmith\SnagIt 7\SnagIt32.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://50.gmodules.com
O15 - Trusted Zone: http://53.gmodules.com
O15 - Trusted Zone: http://www.linkedin.com
O15 - Trusted Zone: http://*.mgc6
O15 - Trusted Zone: http://*.mgcmail2
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {0A2B8FD3-52A3-11D4-9E29-0001023AE3ED} (Crypto Class) - http://support.medgraphics.com/efrontoffic…marsFeather.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {210D0CBC-8B17-48D1-B294-1A338DD2EB3A} (VatCtrl Class) - http://70.88.61.157/VatDec.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {26774F3E-5F15-4883-8394-89146270A8C7} (SynergyOfficeAddin.Connect_Excel) - http://mgcsql/pilot/cab/SynergyOfficeAddin.CAB
O16 - DPF: {42D037E2-DECD-470C-B561-A18043C81B29} (Inter-Tel Unified Communicator Web Client) - http://66.84.153.196/UCROOT/WebCode/WebClient.cab
O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - https://www.microsoft.com/resources/virtual…iveXClient1.cab
O16 - DPF: {7C896371-4B7F-4B34-95B1-24851F5DED24} (Microsoft Virtual Server VMRC Control) - http://microsoft.granitepillar.com/vlatten…tiveXClient.cab
O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - https://transfers.ds.microsoft.com/FTM/Tran…ransferCtrl.cab
O16 - DPF: {8C41EB55-37B2-40CB-8942-F169CA06DB2F} (GPAuthorization Class) - http://microsoft.granitepillar.com/vlatten…d/gpconsole.cab
O16 - DPF: {A7B6FBFE-C894-4954-8377-D1CF19B4E07F} - http://uc.medgraphics.com/WCRS$/applets/OcxLink.cab
O16 - DPF: {B284ECAC-D46D-4354-B185-A5B06A01525D} (Inter-Tel Unified Communicator Administrator) - http://uc.medgraphics.com/UCROOT/WebCode/WebAdmin.cab
O16 - DPF: {BD324C84-E46E-11D3-83D0-00C04F4EB66B} - http://www.deltabike.com/inside/cab/ebcasp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://exact.webex.com/client/v_mywebex-t2…bex/ieatgpc.cab
O16 - DPF: {F3C7C5EE-8BBA-4B6E-8147-3B315A41B85B} - http://uc.medgraphics.com/clientinstall/install.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mgccorp.int
O17 - HKLM\Software\..\Telephony: DomainName = mgccorp.int
O17 - HKLM\System\CCS\Services\Tcpip\..\{7BFF05B4-3A40-4742-99D9-977FAD477CBB}: NameServer = 172.16.0.12
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mgccorp.int
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = mgccorp.int
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = mgccorp.int
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - AppInit_DLLs: wxvault.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Broadcom ASF IP Monitor (ASFIPmon) - Unknown owner - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe" -service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SQL Server FullText Search (MSSQLSERVER) (msftesql) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe" -s:MSSQL.2 -f:MSSQLSERVER (file missing)
O23 - Service: SQL Server (MSSQLSERVER) (MSSQLSERVER) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe" -sMSSQLSERVER (file missing)
O23 - Service: SQL Server Analysis Services (MSSQLSERVER) (MSSQLServerOLAPService) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\OLAP\bin\msmdsrv.exe" -s "C:\Program Files\Microsoft SQL Server\MSSQL.1\OLAP\Config (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
O23 - Service: SQL Server Agent (MSSQLSERVER) (SQLSERVERAGENT) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\SQLAGENT90.EXE" -i MSSQLSERVER (file missing)
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
O23 - Service: NTRU Hybrid TSS v2.0.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
O23 - Service: VMware Converter Service (ufad-p2v) - Unknown owner - C:\Program Files\VMware\VMware Converter\vmware-ufad.exe" -d "C:\Program Files\VMware\VMware Converter\\" -s ufad-p2v.xml (file missing)
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware Registration Service (vmserverdWin32) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

LDTate

Post #8September 3, 2008, 8:46 PM UTC

Open notepad and copy/paste the text in the Codebox below into it:

Folder::
C:\Program Files\eblnryc
C:\Documents and Settings\All Users\Application Data\vebwhklq

Save this as Save this as "CFScript"

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Also please describe how your computer behaves at the moment.

MNBoatMan

Post #9September 5, 2008, 6:46 PM UTC

9/5/08 - STATUS OF COMPUTER:
I do not have any more Internet Explorer problems. Some of my apps not longer function. I am in the process of re-loading those applications however the first two I have tried, still will not run.

Here are the logs you requested.

ComboFix 08-09-01.05 - Administrator 2008-09-05 12:53:05.3 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1686 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\vebwhklq
C:\Program Files\eblnryc

.
((((((((((((((((((((((((( Files Created from 2008-08-05 to 2008-09-05 )))))))))))))))))))))))))))))))
.

2008-09-02 15:21 . 2008-09-02 15:21 d——– C:\Program Files\Trend Micro
2008-09-02 15:05 . 2008-05-29 09:09 38,248 –a—— C:\WINDOWS\system32\drivers\WGX.SYS
2008-09-02 10:44 . 2008-05-29 09:09 91,008 –a—— C:\WINDOWS\system32\drivers\SysPlant.sys
2008-09-02 10:44 . 2008-09-02 10:44 10,652 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-09-02 10:44 . 2008-09-02 10:44 806 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-09-01 15:32 . 2008-09-01 15:32 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-09-01 15:32 . 2008-09-01 15:32 d——– C:\Documents and Settings\Randy-S.MGCCORP\Application Data\Malwarebytes
2008-09-01 15:32 . 2008-09-01 15:32 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-01 15:32 . 2008-08-17 15:01 38,472 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-01 15:32 . 2008-08-17 15:01 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-08-22 15:35 . 2008-08-22 15:35 d–h-c— C:\Documents and Settings\All Users\Application Data\{C236EA39-E76E-497D-8522-DE18F9838F13}
2008-08-22 15:30 . 2008-08-22 15:30 d——– C:\Program Files\InstallAware
2008-08-21 16:15 . 2008-08-21 16:15 d——– C:\TEMP\VMWare
2008-08-19 18:01 . 2007-08-01 22:47 102,664 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2008-08-19 16:53 . 2008-08-19 18:08 d——– C:\Documents and Settings\Randy-S.MGCCORP\.housecall6.6
2008-08-14 16:18 . 2008-08-14 16:18 d——– C:\Program Files\Spybot - Search & Destroy
2008-08-14 15:00 . 2008-08-28 15:51 d——– C:\fixwareout
2008-08-14 14:53 . 2008-09-03 10:34 d——– C:\TEMP\Jump Virus Fix
2008-08-13 18:44 . 2008-05-01 09:30 331,776 ——— C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-11 16:17 . 2008-08-11 16:17 d——– C:\Program Files\Common Files\Merge Modules
2008-08-11 15:44 . 2008-08-11 15:44 d——– C:\Program Files\SQLXML 4.0
2008-08-11 08:41 . 2008-08-11 08:41 d——– C:\Program Files\Microsoft Office Outlook Connector
2008-08-11 08:40 . 2008-08-11 08:40 d——– C:\Program Files\MSECache
2008-08-08 16:02 . 2008-08-08 16:56 d——– C:\Program Files\SQL Server DBA Dashboard
2008-08-08 15:34 . 2008-08-08 15:34 d——– C:\PortQryV2
2008-08-08 09:42 . 2007-12-20 04:01 d——– C:\Documents and Settings\RANDYS03251\ASPNET\Application Data\Wave Systems Corp
2008-08-08 09:42 . 2008-08-08 09:42 d——– C:\Documents and Settings\RANDYS03251\ASPNET
2008-08-08 09:42 . 2008-08-08 09:42 d——– C:\Documents and Settings\RANDYS03251
2008-08-05 16:07 . 2006-10-04 09:06 1,197,294 ——— C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-08-05 16:07 . 2006-10-04 09:06 764,868 ——— C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-08-05 16:07 . 2006-10-04 09:06 217,118 ——— C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-08-05 16:06 . 2008-08-05 16:06 d——– C:\Program Files\Windows Media Connect 2
2008-08-05 16:05 . 2008-08-05 16:06 d——– C:\WINDOWS\system32\drivers\UMDF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-05 17:58 ——— d—–w C:\WINDOWS\system32\config\systemprofile\Application Data\VMware
2008-09-05 17:57 ——— d—–w C:\Documents and Settings\All Users\Application Data\VMware
2008-09-05 15:17 ——— d—–w C:\Documents and Settings\Randy-S.MGCCORP\Application Data\Wave Systems Corp
2008-09-02 15:48 706 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-09-02 15:48 23,888 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-09-02 15:48 10,537 —-a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-09-02 15:48 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-09-02 15:47 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-09-02 15:46 50,536 —-a-w C:\WINDOWS\system32\drivers\WpsHelper.sys
2008-09-02 15:44 136,496 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-09-02 15:44 ——— d—–w C:\Program Files\Symantec
2008-09-02 15:28 ——— d—–w C:\Program Files\Symantec AntiVirus
2008-08-21 19:40 ——— d—–w C:\Documents and Settings\Randy-S.MGCCORP\Application Data\VMware
2008-08-20 13:09 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Wave Systems Corp
2008-08-19 14:06 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-08-18 15:45 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-18 15:43 ——— d—–w C:\Program Files\Microsoft Visual Studio 8
2008-08-15 13:03 ——— d—–w C:\Program Files\Google
2008-08-14 21:25 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-14 20:24 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-11 20:47 ——— d—–w C:\Program Files\Microsoft SQL Server
2008-08-07 15:40 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-08-03 08:01 ——— d—–w C:\Program Files\Microsoft ActiveSync
2002-08-02 12:00 12,348 —-a-w C:\Program Files\viewsonicinstruct_xp.pdf
.

((((((((((((((((((((((((((((( snapshot_2008-09-03_ 9.06.50.85 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-22 18:26:12 20,480 —-a-w C:\WINDOWS\assembly\GAC_MSIL\V4IPCMessage\1.0.1.15035__3cee755285ea1856\V4IPCMessage.dll
+ 2008-09-03 20:55:36 20,480 —-a-w C:\WINDOWS\assembly\GAC_MSIL\V4IPCMessage\1.0.1.15035__3cee755285ea1856\V4IPCMessage.dll
+ 2001-02-03 09:22:28 270,336 —-a-w C:\WINDOWS\CRYSTAL\crxf_pdf.dll
+ 2001-02-03 09:22:48 200,755 —-a-w C:\WINDOWS\CRYSTAL\crxf_rtf.dll
+ 2000-10-26 01:15:00 24,576 —-a-w C:\WINDOWS\CRYSTAL\Crxlat32.dll
+ 2000-11-08 21:46:00 77,824 —-a-w C:\WINDOWS\CRYSTAL\p2bbtrv.dll
+ 2001-02-03 09:26:48 249,856 —-a-w C:\WINDOWS\CRYSTAL\p2bxbse.dll
+ 2000-11-08 21:46:00 53,248 —-a-w C:\WINDOWS\CRYSTAL\p2ctbtrv.dll
+ 2000-11-08 21:46:00 245,760 —-a-w C:\WINDOWS\CRYSTAL\p2ixbse.dll
+ 2001-02-03 09:26:48 102,400 —-a-w C:\WINDOWS\CRYSTAL\P2ldb2.dll
+ 2001-02-03 09:26:48 90,112 —-a-w C:\WINDOWS\CRYSTAL\P2LIFMX.dll
+ 2001-02-03 09:26:48 131,072 —-a-w C:\WINDOWS\CRYSTAL\p2lodbc.dll
+ 2001-02-03 09:26:48 98,304 —-a-w C:\WINDOWS\CRYSTAL\p2lora7.dll
+ 2001-02-03 09:26:48 98,304 —-a-w C:\WINDOWS\CRYSTAL\P2lsql.dll
+ 2001-02-03 09:26:48 155,648 —-a-w C:\WINDOWS\CRYSTAL\P2lsyb10.dll
+ 2001-02-03 09:26:48 282,624 —-a-w C:\WINDOWS\CRYSTAL\p2molap.dll
+ 2001-02-03 09:26:48 167,936 —-a-w C:\WINDOWS\CRYSTAL\p2sdb2.dll
+ 2001-02-03 09:26:50 77,824 —-a-w C:\WINDOWS\CRYSTAL\p2sfs.dll
+ 2001-02-03 09:26:50 167,936 —-a-w C:\WINDOWS\CRYSTAL\p2sifmx.dll
+ 2001-01-12 16:08:36 299,008 —-a-w C:\WINDOWS\CRYSTAL\p2smcube.dll
+ 2001-02-03 09:26:50 270,336 —-a-w C:\WINDOWS\CRYSTAL\p2solap.dll
+ 2001-02-03 09:26:50 204,800 —-a-w C:\WINDOWS\CRYSTAL\p2soledb.dll
+ 2001-02-03 09:26:50 167,936 —-a-w C:\WINDOWS\CRYSTAL\p2sora7.dll
+ 2001-02-03 09:26:50 168,000 —-a-w C:\WINDOWS\CRYSTAL\p2ssql.dll
+ 2001-02-03 09:26:50 159,744 —-a-w C:\WINDOWS\CRYSTAL\p2ssyb10.dll
+ 2000-11-08 21:46:00 24,576 —-a-w C:\WINDOWS\CRYSTAL\u252000.dll
+ 2000-11-08 21:46:00 24,576 —-a-w C:\WINDOWS\CRYSTAL\u25dts.dll
+ 2000-11-08 21:46:00 28,672 —-a-w C:\WINDOWS\CRYSTAL\u2dapp.dll
+ 2001-02-03 14:05:56 28,672 —-a-w C:\WINDOWS\CRYSTAL\u2ddisk.dll
+ 2000-11-08 21:46:00 40,960 —-a-w C:\WINDOWS\CRYSTAL\u2dmapi.dll
+ 2000-11-08 21:46:00 53,248 —-a-w C:\WINDOWS\CRYSTAL\u2dnotes.dll
+ 2001-02-03 14:05:56 102,400 —-a-w C:\WINDOWS\CRYSTAL\u2dpost.dll
+ 2000-11-08 21:46:00 57,344 —-a-w C:\WINDOWS\CRYSTAL\u2dvim.dll
+ 2001-02-03 14:05:56 28,672 —-a-w C:\WINDOWS\CRYSTAL\u2fcr.dll
+ 2001-02-03 14:05:56 36,864 —-a-w C:\WINDOWS\CRYSTAL\u2fdif.dll
+ 2001-02-03 14:05:56 45,056 —-a-w C:\WINDOWS\CRYSTAL\u2fhtml.dll
+ 2001-02-03 14:05:56 49,152 —-a-w C:\WINDOWS\CRYSTAL\u2fodbc.dll
+ 2000-10-26 01:15:00 65,536 —-a-w C:\WINDOWS\CRYSTAL\u2frdef.dll
+ 2001-02-03 14:05:56 36,864 —-a-w C:\WINDOWS\CRYSTAL\u2frec.dll
+ 2000-11-08 21:46:00 36,864 —-a-w C:\WINDOWS\CRYSTAL\u2fsepv.dll
+ 2001-02-03 14:05:56 90,112 —-a-w C:\WINDOWS\CRYSTAL\u2ftext.dll
+ 2000-11-08 21:46:00 40,960 —-a-w C:\WINDOWS\CRYSTAL\u2fwks.dll
+ 2001-02-03 14:05:56 106,496 —-a-w C:\WINDOWS\CRYSTAL\u2fwordw.dll
+ 2001-02-03 14:05:56 212,992 —-a-w C:\WINDOWS\CRYSTAL\u2fxls.dll
+ 2001-02-03 09:28:16 225,280 —-a-w C:\WINDOWS\CRYSTAL\u2fxml.dll
+ 2000-11-08 21:46:00 24,576 —-a-w C:\WINDOWS\CRYSTAL\u2l2000.dll
+ 2000-11-08 21:46:00 45,056 —-a-w C:\WINDOWS\CRYSTAL\u2lcom.dll
+ 2000-11-08 21:46:00 24,576 —-a-w C:\WINDOWS\CRYSTAL\u2ldts.dll
+ 2000-11-08 21:46:00 28,672 —-a-w C:\WINDOWS\CRYSTAL\u2lexch.dll
+ 2000-11-08 21:46:00 49,152 —-a-w C:\WINDOWS\CRYSTAL\u2lfinra.dll
+ 2000-11-08 21:46:00 24,576 —-a-w C:\WINDOWS\CRYSTAL\u2lsamp1.dll
+ 2006-11-20 15:58:12 290,816 —-a-w C:\WINDOWS\Downloaded Program Files\ebcasp.dll
+ 2008-09-05 17:31:24 4,286 —-a-r C:\WINDOWS\Installer\{39A3DC93-4EE4-40A8-A85E-6188BDABD651}\ARPPRODUCTICON.exe
+ 2008-09-05 17:31:24 40,960 —-a-r C:\WINDOWS\Installer\{39A3DC93-4EE4-40A8-A85E-6188BDABD651}\NewShortcut1.C243EA46_73AF_4054_AF41_ADC098165B19.EXE
+ 2008-09-05 17:31:24 40,960 —-a-r C:\WINDOWS\Installer\{39A3DC93-4EE4-40A8-A85E-6188BDABD651}\NewShortcut1.D9FA6856_FF03_4C42_A2B3_B51115BCF574.exe
+ 2008-09-05 17:31:24 40,960 —-a-r C:\WINDOWS\Installer\{39A3DC93-4EE4-40A8-A85E-6188BDABD651}\NewShortcut2.4BD99262_AED8_4B84_8316_991180332D0F.exe
+ 2008-09-05 17:31:24 40,960 —-a-r C:\WINDOWS\Installer\{39A3DC93-4EE4-40A8-A85E-6188BDABD651}\NewShortcut3.4BD99262_AED8_4B84_8316_991180332D0F.exe
+ 2008-09-05 17:31:24 40,960 —-a-r C:\WINDOWS\Installer\{39A3DC93-4EE4-40A8-A85E-6188BDABD651}\NewShortcut5.4BD99262_AED8_4B84_8316_991180332D0F.exe
+ 2008-09-05 17:31:24 45,056 —-a-r C:\WINDOWS\Installer\{39A3DC93-4EE4-40A8-A85E-6188BDABD651}\NewShortcut6.4BD99262_AED8_4B84_8316_991180332D0F.exe
+ 2008-09-05 17:31:24 40,960 —-a-r C:\WINDOWS\Installer\{39A3DC93-4EE4-40A8-A85E-6188BDABD651}\NewShortcut8.4BD99262_AED8_4B84_8316_991180332D0F.exe
+ 2008-09-05 17:31:24 40,960 —-a-r C:\WINDOWS\Installer\{39A3DC93-4EE4-40A8-A85E-6188BDABD651}\NewShortcut9.4BD99262_AED8_4B84_8316_991180332D0F.exe
- 2006-12-29 18:35:12 14,336 —-a-r C:\WINDOWS\Installer\{7699B723-9718-41DE-8C18-549F341C02CE}\SCRIcons.exe
+ 2008-09-03 15:47:04 14,336 —-a-r C:\WINDOWS\Installer\{7699B723-9718-41DE-8C18-549F341C02CE}\SCRIcons.exe
- 2008-09-02 15:49:28 16,384 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-09-03 23:01:47 16,384 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-09-02 15:49:28 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-09-03 23:01:47 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-09-02 15:49:28 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-09-03 23:01:47 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2000-11-09 21:52:00 618,496 —-a-w C:\WINDOWS\system32\Crpaig80.dll
+ 2001-02-03 09:26:52 663,609 —-a-w C:\WINDOWS\system32\exlate32.dll
+ 2000-10-26 01:15:00 17,920 —-a-w C:\WINDOWS\system32\Implode.dll
- 2008-09-03 14:04:22 252,793 —-a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
+ 2008-09-05 18:00:57 252,793 —-a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
- 2008-09-02 20:34:55 544,816 —-a-w C:\WINDOWS\system32\pscl.dll
+ 2008-09-05 17:28:44 544,816 —-a-w C:\WINDOWS\system32\pscl.dll
- 2008-09-02 20:34:55 254,002 —-a-w C:\WINDOWS\system32\pscore.dll
+ 2008-09-05 17:28:44 254,002 —-a-w C:\WINDOWS\system32\pscore.dll
+ 2008-09-05 17:56:58 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_7b8.dat
+ 2008-09-05 17:58:25 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_cf4.dat
+ 2008-09-05 17:58:11 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_f30.dat
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-03-12 7204864]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 221184]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2006-04-26 143360]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 282624]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-05-29 115560]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
EMBASSY Trust Suite Secure Update.lnk - C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe [2006-01-30 192512]
SnagIt 7.lnk - C:\Program Files\TechSmith\SnagIt 7\SnagIt32.exe [2005-06-17 3719168]
Windows Desktop Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2006-10-19 110080]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-10-19 293888]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wxvault.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.rhetorex"= RHETOREX.ACM

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antvirus]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Randy-S.MGCCORP^Start Menu^Programs^Startup^Launch SymmTime.exe.lnk]
path=C:\Documents and Settings\Randy-S.MGCCORP\Start Menu\Programs\Startup\Launch SymmTime.exe.lnk
backup=C:\WINDOWS\pss\Launch SymmTime.exe.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANT Agent]
–a—— 2008-04-04 10:53 8211544 C:\Garmin\ANT Agent\ANT Agent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BuildBU]
–a—— 2004-02-19 06:23 61440 c:\dell\bldbubg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Document Manager]
–a—— 2006-05-16 12:35 102400 C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
——— 2005-12-09 20:29 49152 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
–a—— 2006-08-30 11:48 28672 c:\dell\E-Center\EULAl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EFI Job Monitor]
–a—— 2006-07-18 18:05 3067904 C:\WINDOWS\system32\spool\drivers\w32x86\3\efjm.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
–a—— 2006-11-13 13:39 1289000 C:\Program Files\Microsoft ActiveSync\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
–a—— 2004-07-27 16:50 221184 C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
–a—— 2004-07-27 16:50 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
–a—— 2005-06-08 15:44 196608 C:\Program Files\Logitech\Video\ManifestEngine.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
–a—— 2005-06-08 16:24 458752 C:\Program Files\Logitech\Video\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
–a—— 2005-06-08 16:14 217088 C:\Program Files\Logitech\Video\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder]
-ra—— 2006-01-30 11:00 98304 C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2007-02-16 10:54 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2005-11-10 13:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
–a—— 2006-03-20 15:00 282624 C:\WINDOWS\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 PBADRV;PBADRV;C:\WINDOWS\system32\drivers\pbadrv.sys [2005-12-09 18816]
R2 ASFIPmon;Broadcom ASF IP Monitor;C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe [2006-03-17 65536]
R2 MsDtsServer;SQL Server Integration Services;C:\Program Files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe [2005-10-14 199384]
R2 MSExchangeMGMT;Microsoft Exchange Management;C:\Program Files\Exchsrvr\bin\exmgmt.exe [2003-06-24 3117568]
R2 ReportServer;SQL Server Reporting Services (MSSQLSERVER);C:\Program Files\Microsoft SQL Server\MSSQL.3\Reporting Services\ReportServer\bin\ReportingServicesService.exe [2005-10-14 14552]
R2 SSService;Visual SourceSafe LAN Service;C:\Program Files\Microsoft Visual SourceSafe\SSService.EXE [2007-11-21 329728]
R2 ufad-p2v;VMware Converter Service;C:\Program Files\VMware\VMware Converter\vmware-ufad.exe [2007-11-01 176128]
R2 vmserverdWin32;VMware Registration Service;C:\Program Files\VMware\VMware Server\vmserverdWin32.exe [2007-04-12 1646685]
R2 vstor2-p2v30;Vstor2 P2V30 Virtual Storage Driver;C:\Program Files\VMware\VMware Converter\vstor2-p2v30.sys [2007-11-01 19248]
R2 WGX;Extend WG Protocol Driver;C:\WINDOWS\system32\Drivers\WGX.SYS [2008-05-29 38248]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-09-02 23888]
S3 DSI_SiUSBXp_3_1;DSI_SiUSBXp_3_1;C:\WINDOWS\system32\drivers\DSI_SiUSBXp_3_1.sys [2007-09-06 14848]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2006-12-02 2805000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f216dc9c-dbf9-11dc-9887-005056c00008}]
\Shell\Auto\command - RavMonE.exe e
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMonE.exe e
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-05 13:00:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\msftesql]
"ImagePath"="\"C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe\" -s:MSSQL.2 -f:MSSQLSERVER"

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\vsdatant]
"ImagePath"="a"
.
———————— Other Running Processes ————————
.
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Wave Systems Corp\common\DataServer.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\OLAP\bin\msmdsrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
C:\Program Files\VMware\VMware Server\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\searchindexer.exe
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\TechSmith\SnagIt 7\TscHelp.exe
C:\WINDOWS\system32\verclsid.exe
.
**************************************************************************
.
Completion time: 2008-09-05 13:04:19 - machine was rebooted [Randy-s]
ComboFix-quarantined-files.txt 2008-09-05 18:04:13
ComboFix2.txt 2008-09-03 14:07:36
ComboFix3.txt 2008-09-02 14:53:35

Pre-Run: 31,369,334,784 bytes free
Post-Run: 31,616,126,976 bytes free

319 — E O F — 2008-08-19 08:00:24

Logfile of HijackThis v1.99.1
Scan saved at 13:11, on 2008-09-05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\Wave Systems Corp\Common\DataServer.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft SQL Server\MSSQL.3\Reporting Services\ReportServer\bin\ReportingServicesService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
C:\Program Files\VMware\VMware Converter\vmware-ufad.exe
C:\Program Files\VMware\VMware Server\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Exchsrvr\bin\exmgmt.exe
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\TechSmith\SnagIt 7\SnagIt32.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\TechSmith\SnagIt 7\TSCHelp.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mgcsql/esynergy/docs/bp.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5061024
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = mgcisa:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.1.*;66.84.153.*;
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
O4 - Global Startup: SnagIt 7.lnk = C:\Program Files\TechSmith\SnagIt 7\SnagIt32.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://50.gmodules.com
O15 - Trusted Zone: http://53.gmodules.com
O15 - Trusted Zone: http://www.linkedin.com
O15 - Trusted Zone: http://*.mgc6
O15 - Trusted Zone: http://*.mgcmail2
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {0A2B8FD3-52A3-11D4-9E29-0001023AE3ED} (Crypto Class) - http://support.medgraphics.com/efrontoffic…marsFeather.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {210D0CBC-8B17-48D1-B294-1A338DD2EB3A} (VatCtrl Class) - http://70.88.61.157/VatDec.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {26774F3E-5F15-4883-8394-89146270A8C7} (SynergyOfficeAddin.Connect_Excel) - http://mgcsql/pilot/cab/SynergyOfficeAddin.CAB
O16 - DPF: {42D037E2-DECD-470C-B561-A18043C81B29} (Inter-Tel Unified Communicator Web Client) - http://66.84.153.196/UCROOT/WebCode/WebClient.cab
O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - https://www.microsoft.com/resources/virtual…iveXClient1.cab
O16 - DPF: {7C896371-4B7F-4B34-95B1-24851F5DED24} (Microsoft Virtual Server VMRC Control) - http://microsoft.granitepillar.com/vlatten…tiveXClient.cab
O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - https://transfers.ds.microsoft.com/FTM/Tran…ransferCtrl.cab
O16 - DPF: {8C41EB55-37B2-40CB-8942-F169CA06DB2F} (GPAuthorization Class) - http://microsoft.granitepillar.com/vlatten…d/gpconsole.cab
O16 - DPF: {A7B6FBFE-C894-4954-8377-D1CF19B4E07F} - http://uc.medgraphics.com/WCRS$/applets/OcxLink.cab
O16 - DPF: {B284ECAC-D46D-4354-B185-A5B06A01525D} (Inter-Tel Unified Communicator Administrator) - http://uc.medgraphics.com/UCROOT/WebCode/WebAdmin.cab
O16 - DPF: {BD324C84-E46E-11D3-83D0-00C04F4EB66B} (HTMLParser Class) - http://mgcsql/esynergy/cab/ebcasp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://exact.webex.com/client/v_mywebex-t2…bex/ieatgpc.cab
O16 - DPF: {F3C7C5EE-8BBA-4B6E-8147-3B315A41B85B} - http://uc.medgraphics.com/clientinstall/install.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mgccorp.int
O17 - HKLM\Software\..\Telephony: DomainName = mgccorp.int
O17 - HKLM\System\CCS\Services\Tcpip\..\{7BFF05B4-3A40-4742-99D9-977FAD477CBB}: NameServer = 172.16.0.12
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mgccorp.int
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = mgccorp.int
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = mgccorp.int
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - AppInit_DLLs: wxvault.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Broadcom ASF IP Monitor (ASFIPmon) - Unknown owner - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe" -service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SQL Server FullText Search (MSSQLSERVER) (msftesql) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe" -s:MSSQL.2 -f:MSSQLSERVER (file missing)
O23 - Service: SQL Server (MSSQLSERVER) (MSSQLSERVER) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe" -sMSSQLSERVER (file missing)
O23 - Service: SQL Server Analysis Services (MSSQLSERVER) (MSSQLServerOLAPService) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\OLAP\bin\msmdsrv.exe" -s "C:\Program Files\Microsoft SQL Server\MSSQL.1\OLAP\Config (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
O23 - Service: SQL Server Agent (MSSQLSERVER) (SQLSERVERAGENT) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\SQLAGENT90.EXE" -i MSSQLSERVER (file missing)
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
O23 - Service: NTRU Hybrid TSS v2.0.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
O23 - Service: VMware Converter Service (ufad-p2v) - Unknown owner - C:\Program Files\VMware\VMware Converter\vmware-ufad.exe" -d "C:\Program Files\VMware\VMware Converter\\" -s ufad-p2v.xml (file missing)
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware Registration Service (vmserverdWin32) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

LDTate

Post #10September 5, 2008, 8:36 PM UTC

Sorry I missed one.

Open notepad and copy/paste the text in the Codebox below into it:

Registry::
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

MNBoatMan

Post #11September 9, 2008, 3:24 PM UTC

9/9/08 Update on how my computer is operating. I found out that when HyjackThis is installed, I cannot log into our manufacturing application. I have since uninstalled HyjackThis and Spybot Search and Destroy. My computer appears to be running correctly now. I still can only run ComboFix in safe mode though.

ComboFix 08-09-01.05 - Randy-s 2008-09-09 7:59:26.4 - NTFSx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1656 [GMT -5:00]
Running from: C:\DOCUME~1\RANDY-~1.MGC\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Randy-S.MGCCORP\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-08-09 to 2008-09-09 )))))))))))))))))))))))))))))))
.

2008-09-05 14:03 . 2008-09-05 14:03 0 –a—— C:\WINDOWS\sysman.trk
2008-09-05 13:48 . 2008-09-05 13:48 2,560 –a—— C:\WINDOWS\_MSRSTRT.EXE
2008-09-05 13:21 . 2003-10-09 10:13 5,042,233 –a—— C:\WINDOWS\system32\crpe32.dll
2008-09-02 15:21 . 2008-09-02 15:21 d——– C:\Program Files\Trend Micro
2008-09-02 15:05 . 2008-05-29 09:09 38,248 –a—— C:\WINDOWS\system32\drivers\WGX.SYS
2008-09-02 10:44 . 2008-05-29 09:09 91,008 –a—— C:\WINDOWS\system32\drivers\SysPlant.sys
2008-09-02 10:44 . 2008-09-02 10:44 10,652 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-09-02 10:44 . 2008-09-02 10:44 806 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-09-01 15:32 . 2008-09-01 15:32 d——– C:\Documents and Settings\Randy-S.MGCCORP\Application Data\Malwarebytes
2008-09-01 15:32 . 2008-09-01 15:32 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-22 15:35 . 2008-08-22 15:35 d–h-c— C:\Documents and Settings\All Users\Application Data\{C236EA39-E76E-497D-8522-DE18F9838F13}
2008-08-22 15:30 . 2008-08-22 15:30 d——– C:\Program Files\InstallAware
2008-08-21 16:15 . 2008-08-21 16:15 d——– C:\TEMP\VMWare
2008-08-19 18:01 . 2007-08-01 22:47 102,664 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2008-08-19 16:53 . 2008-08-19 18:08 d——– C:\Documents and Settings\Randy-S.MGCCORP\.housecall6.6
2008-08-14 16:18 . 2008-09-05 13:56 d——– C:\Program Files\Spybot - Search & Destroy
2008-08-14 15:00 . 2008-08-28 15:51 d——– C:\fixwareout
2008-08-14 14:53 . 2008-09-05 13:11 d——– C:\TEMP\Jump Virus Fix
2008-08-13 18:44 . 2008-05-01 09:30 331,776 ——— C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-11 16:17 . 2008-08-11 16:17 d——– C:\Program Files\Common Files\Merge Modules
2008-08-11 15:44 . 2008-08-11 15:44 d——– C:\Program Files\SQLXML 4.0
2008-08-11 08:41 . 2008-08-11 08:41 d——– C:\Program Files\Microsoft Office Outlook Connector
2008-08-11 08:40 . 2008-08-11 08:40 d——– C:\Program Files\MSECache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-09 13:05 ——— d—–w C:\WINDOWS\system32\config\systemprofile\Application Data\VMware
2008-09-09 13:03 ——— d—–w C:\Documents and Settings\All Users\Application Data\VMware
2008-09-09 12:52 ——— d—–w C:\Documents and Settings\Randy-S.MGCCORP\Application Data\Wave Systems Corp
2008-09-05 18:56 ——— d—–w C:\Program Files\Hewlett-Packard
2008-09-05 18:56 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-05 18:49 ——— d—–w C:\Program Files\Unified Messaging
2008-09-05 18:21 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-09-05 17:28 544,816 —-a-w C:\WINDOWS\system32\pscl.dll
2008-09-05 17:28 254,002 —-a-w C:\WINDOWS\system32\pscore.dll
2008-09-02 15:48 706 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-09-02 15:48 23,888 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-09-02 15:48 10,537 —-a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-09-02 15:48 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-09-02 15:47 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-09-02 15:46 50,536 —-a-w C:\WINDOWS\system32\drivers\WpsHelper.sys
2008-09-02 15:44 60,808 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
2008-09-02 15:44 136,496 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-09-02 15:44 ——— d—–w C:\Program Files\Symantec
2008-09-02 15:28 ——— d—–w C:\Program Files\Symantec AntiVirus
2008-08-21 19:40 ——— d—–w C:\Documents and Settings\Randy-S.MGCCORP\Application Data\VMware
2008-08-20 13:09 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Wave Systems Corp
2008-08-19 14:06 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-08-18 15:45 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-18 15:43 ——— d—–w C:\Program Files\Microsoft Visual Studio 8
2008-08-15 13:03 ——— d—–w C:\Program Files\Google
2008-08-14 20:24 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-11 20:47 ——— d—–w C:\Program Files\Microsoft SQL Server
2008-08-08 21:56 ——— d—–w C:\Program Files\SQL Server DBA Dashboard
2008-08-05 21:06 ——— d—–w C:\Program Files\Windows Media Connect 2
2008-08-03 08:01 ——— d—–w C:\Program Files\Microsoft ActiveSync
2008-07-19 03:10 94,920 —-a-w C:\WINDOWS\system32\dllcache\cdm.dll
2008-07-19 03:10 94,920 —-a-w C:\WINDOWS\system32\cdm.dll
2008-07-19 03:10 53,448 —-a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-19 03:10 53,448 —-a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2008-07-19 03:10 45,768 —-a-w C:\WINDOWS\system32\wups2.dll
2008-07-19 03:10 36,552 —-a-w C:\WINDOWS\system32\wups.dll
2008-07-19 03:10 36,552 —-a-w C:\WINDOWS\system32\dllcache\wups.dll
2008-07-19 03:09 563,912 —-a-w C:\WINDOWS\system32\wuapi.dll
2008-07-19 03:09 563,912 —-a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2008-07-19 03:09 325,832 —-a-w C:\WINDOWS\system32\wucltui.dll
2008-07-19 03:09 325,832 —-a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2008-07-19 03:09 205,000 —-a-w C:\WINDOWS\system32\wuweb.dll
2008-07-19 03:09 205,000 —-a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2008-07-19 03:09 1,811,656 —-a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-19 03:09 1,811,656 —-a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2008-07-19 03:07 270,880 —-a-w C:\WINDOWS\system32\mucltui.dll
2008-07-19 03:07 210,976 —-a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:32 253,952 —-a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:32 253,952 ——w C:\WINDOWS\system32\dllcache\es.dll
2008-06-24 16:23 74,240 —-a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:23 74,240 ——w C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-24 15:57 3,592,192 ——w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-06-23 09:20 70,656 ——w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-06-23 09:20 625,664 ——w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-06-23 09:20 13,824 ——w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-06-21 05:23 161,792 ——w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-06-20 17:41 245,248 —-a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41 245,248 ——w C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:41 148,992 —-a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 —-a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ——w C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:52 225,920 —-a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-13 13:10 272,128 ——w C:\WINDOWS\system32\dllcache\bthport.sys
2002-08-02 12:00 12,348 —-a-w C:\Program Files\viewsonicinstruct_xp.pdf
.

((((((((((((((((((((((((((((( snapshot_2008-09-05_13.03.36.98 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-09-05 18:48:19 2,560 —-a-w C:\WINDOWS\_MSRSTRT.EXE
- 2008-09-03 20:55:36 20,480 —-a-w C:\WINDOWS\assembly\GAC_MSIL\V4IPCMessage\1.0.1.15035__3cee755285ea1856\V4IPCMessage.dll
+ 2008-09-05 18:41:58 20,480 —-a-w C:\WINDOWS\assembly\GAC_MSIL\V4IPCMessage\1.0.1.15035__3cee755285ea1856\V4IPCMessage.dll
- 2001-02-03 09:22:28 270,336 —-a-w C:\WINDOWS\CRYSTAL\crxf_pdf.dll
+ 2003-07-25 07:22:40 200,704 —-a-w C:\WINDOWS\CRYSTAL\crxf_pdf.dll
- 2001-02-03 09:22:48 200,755 —-a-w C:\WINDOWS\CRYSTAL\crxf_rtf.dll
+ 2001-11-14 13:18:22 180,275 ——w C:\WINDOWS\CRYSTAL\crxf_rtf.dll
- 2000-11-08 21:46:00 77,824 —-a-w C:\WINDOWS\CRYSTAL\p2bbtrv.dll
+ 2001-11-26 15:08:50 77,824 ——w C:\WINDOWS\CRYSTAL\p2bbtrv.dll
- 2001-02-03 09:26:48 249,856 —-a-w C:\WINDOWS\CRYSTAL\p2bxbse.dll
+ 2001-12-05 21:53:22 249,856 ——w C:\WINDOWS\CRYSTAL\p2bxbse.dll
- 2000-11-08 21:46:00 53,248 —-a-w C:\WINDOWS\CRYSTAL\p2ctbtrv.dll
+ 2001-11-26 15:09:08 53,248 ——w C:\WINDOWS\CRYSTAL\p2ctbtrv.dll
- 2001-02-03 09:26:48 102,400 —-a-w C:\WINDOWS\CRYSTAL\P2ldb2.dll
+ 2001-04-02 06:07:46 102,400 —-a-w C:\WINDOWS\CRYSTAL\p2ldb2.dll
- 2001-02-03 09:26:48 131,072 —-a-w C:\WINDOWS\CRYSTAL\p2lodbc.dll
+ 2003-08-19 19:37:18 187,392 —-a-w C:\WINDOWS\CRYSTAL\p2lodbc.dll
- 2001-02-03 09:26:48 98,304 —-a-w C:\WINDOWS\CRYSTAL\P2lsql.dll
+ 2001-02-09 15:00:52 98,304 —-a-w C:\WINDOWS\CRYSTAL\P2lsql.dll
- 2001-02-03 09:26:48 155,648 —-a-w C:\WINDOWS\CRYSTAL\P2lsyb10.dll
+ 2001-02-09 15:09:02 155,648 —-a-w C:\WINDOWS\CRYSTAL\P2lsyb10.dll
- 2001-02-03 09:26:48 167,936 —-a-w C:\WINDOWS\CRYSTAL\p2sdb2.dll
+ 2003-03-21 09:56:40 172,032 —-a-w C:\WINDOWS\CRYSTAL\p2sdb2.dll
- 2001-02-03 09:26:50 167,936 —-a-w C:\WINDOWS\CRYSTAL\p2sifmx.dll
+ 2002-01-02 13:29:58 167,936 ——w C:\WINDOWS\CRYSTAL\p2sifmx.dll
- 2001-02-03 09:26:50 270,336 —-a-w C:\WINDOWS\CRYSTAL\p2solap.dll
+ 2001-02-22 19:08:40 270,336 —-a-w C:\WINDOWS\CRYSTAL\p2solap.dll
- 2001-02-03 09:26:50 204,800 —-a-w C:\WINDOWS\CRYSTAL\p2soledb.dll
+ 2002-09-25 03:09:58 208,896 —-a-w C:\WINDOWS\CRYSTAL\p2soledb.dll
- 2001-02-03 09:26:50 167,936 —-a-w C:\WINDOWS\CRYSTAL\p2sora7.dll
+ 2003-02-21 10:44:06 176,128 —-a-w C:\WINDOWS\CRYSTAL\p2sora7.dll
- 2001-02-03 09:26:50 168,000 —-a-w C:\WINDOWS\CRYSTAL\p2ssql.dll
+ 2002-08-23 03:02:22 168,000 ——w C:\WINDOWS\CRYSTAL\p2ssql.dll
- 2001-02-03 09:26:50 159,744 —-a-w C:\WINDOWS\CRYSTAL\p2ssyb10.dll
+ 2003-08-12 18:51:56 212,992 —-a-w C:\WINDOWS\CRYSTAL\p2ssyb10.dll
- 2001-02-03 14:05:56 28,672 —-a-w C:\WINDOWS\CRYSTAL\u2ddisk.dll
+ 2002-01-04 14:54:14 28,672 ——w C:\WINDOWS\CRYSTAL\u2ddisk.dll
- 2000-11-08 21:46:00 40,960 —-a-w C:\WINDOWS\CRYSTAL\u2dmapi.dll
+ 2001-12-14 19:24:16 40,960 ——w C:\WINDOWS\CRYSTAL\u2dmapi.dll
- 2000-11-08 21:46:00 53,248 —-a-w C:\WINDOWS\CRYSTAL\u2dnotes.dll
+ 2001-07-26 18:32:50 53,248 ——w C:\WINDOWS\CRYSTAL\u2dnotes.dll
- 2001-02-03 14:05:56 36,864 —-a-w C:\WINDOWS\CRYSTAL\u2fdif.dll
+ 2001-12-12 13:12:30 36,864 ——w C:\WINDOWS\CRYSTAL\u2fdif.dll
- 2001-02-03 14:05:56 45,056 —-a-w C:\WINDOWS\CRYSTAL\u2fhtml.dll
+ 2001-06-19 17:06:58 45,056 ——w C:\WINDOWS\CRYSTAL\u2fhtml.dll
- 2001-02-03 14:05:56 49,152 —-a-w C:\WINDOWS\CRYSTAL\u2fodbc.dll
+ 2003-07-09 07:24:46 53,248 —-a-w C:\WINDOWS\CRYSTAL\u2fodbc.dll
- 2001-02-03 14:05:56 36,864 —-a-w C:\WINDOWS\CRYSTAL\u2frec.dll
+ 2001-12-12 13:14:00 36,864 ——w C:\WINDOWS\CRYSTAL\u2frec.dll
- 2000-11-08 21:46:00 36,864 —-a-w C:\WINDOWS\CRYSTAL\u2fsepv.dll
+ 2003-03-28 06:07:00 40,960 —-a-w C:\WINDOWS\CRYSTAL\u2fsepv.dll
- 2001-02-03 14:05:56 90,112 —-a-w C:\WINDOWS\CRYSTAL\u2ftext.dll
+ 2003-09-11 12:07:28 98,304 —-a-w C:\WINDOWS\CRYSTAL\u2ftext.dll
- 2000-11-08 21:46:00 40,960 —-a-w C:\WINDOWS\CRYSTAL\u2fwks.dll
+ 2001-12-12 19:33:12 40,960 ——w C:\WINDOWS\CRYSTAL\u2fwks.dll
- 2001-02-03 14:05:56 106,496 —-a-w C:\WINDOWS\CRYSTAL\u2fwordw.dll
+ 2001-04-11 18:49:00 106,496 —-a-w C:\WINDOWS\CRYSTAL\u2fwordw.dll
- 2001-02-03 14:05:56 212,992 —-a-w C:\WINDOWS\CRYSTAL\u2fxls.dll
+ 2003-08-08 16:56:52 225,280 —-a-w C:\WINDOWS\CRYSTAL\u2fxls.dll
+ 1998-04-03 21:00:00 40,960 ——w C:\WINDOWS\CRYSTAL\U2LBAR.DLL
- 2000-11-08 21:46:00 45,056 —-a-w C:\WINDOWS\CRYSTAL\u2lcom.dll
+ 2002-09-04 20:37:26 106,496 —-a-w C:\WINDOWS\CRYSTAL\u2lcom.dll
+ 2006-09-12 23:26:56 151,608 ——w C:\WINDOWS\CRYSTAL\u2lmax.dll
+ 1997-11-13 18:57:18 2,006 ——w C:\WINDOWS\SSF.BAT
- 2000-11-09 21:52:00 618,496 —-a-w C:\WINDOWS\system32\Crpaig80.dll
+ 2002-04-03 18:52:16 622,592 —-a-w C:\WINDOWS\system32\Crpaig80.dll
+ 2001-02-03 07:59:28 49,223 ——w C:\WINDOWS\system32\crtslv.dll
- 2001-02-03 09:26:52 663,609 —-a-w C:\WINDOWS\system32\exlate32.dll
+ 2003-07-21 15:57:24 675,897 —-a-w C:\WINDOWS\system32\exlate32.dll
+ 2001-02-03 09:22:08 307,200 ——w C:\WINDOWS\system32\ExportModeller.dll
- 2008-09-05 18:00:57 252,793 —-a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
+ 2008-09-09 13:03:15 252,790 —-a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
+ 2000-05-24 03:45:58 118,784 ——w C:\WINDOWS\system32\MSSTDFMT.DLL
+ 2002-04-23 06:10:18 1,230,336 ——w C:\WINDOWS\system32\msxml4.dll
+ 2002-04-23 06:10:14 44,544 ——w C:\WINDOWS\system32\msxml4a.dll
+ 2002-04-23 06:10:06 82,432 ——w C:\WINDOWS\system32\msxml4r.dll
+ 2008-09-09 13:03:04 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_210.dat
+ 2008-09-09 13:04:33 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_d58.dat
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-03-12 7204864]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 221184]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2006-04-26 143360]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 282624]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-05-29 115560]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
EMBASSY Trust Suite Secure Update.lnk - C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe [2006-01-30 192512]
SnagIt 7.lnk - C:\Program Files\TechSmith\SnagIt 7\SnagIt32.exe [2005-06-17 3719168]
Windows Desktop Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2006-10-19 110080]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-10-19 293888]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wxvault.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.rhetorex"= RHETOREX.ACM

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antvirus]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Randy-S.MGCCORP^Start Menu^Programs^Startup^Launch SymmTime.exe.lnk]
path=C:\Documents and Settings\Randy-S.MGCCORP\Start Menu\Programs\Startup\Launch SymmTime.exe.lnk
backup=C:\WINDOWS\pss\Launch SymmTime.exe.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANT Agent]
–a—— 2008-04-04 10:53 8211544 C:\Garmin\ANT Agent\ANT Agent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BuildBU]
–a—— 2004-02-19 06:23 61440 c:\dell\bldbubg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Document Manager]
–a—— 2006-05-16 12:35 102400 C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
——— 2005-12-09 20:29 49152 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
–a—— 2006-08-30 11:48 28672 c:\dell\E-Center\EULAl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EFI Job Monitor]
–a—— 2006-07-18 18:05 3067904 C:\WINDOWS\system32\spool\drivers\w32x86\3\efjm.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
–a—— 2006-11-13 13:39 1289000 C:\Program Files\Microsoft ActiveSync\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
–a—— 2004-07-27 16:50 221184 C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
–a—— 2004-07-27 16:50 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
–a—— 2005-06-08 15:44 196608 C:\Program Files\Logitech\Video\ManifestEngine.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
–a—— 2005-06-08 16:24 458752 C:\Program Files\Logitech\Video\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
–a—— 2005-06-08 16:14 217088 C:\Program Files\Logitech\Video\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2007-02-16 10:54 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2005-11-10 13:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
–a—— 2006-03-20 15:00 282624 C:\WINDOWS\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 PBADRV;PBADRV;C:\WINDOWS\system32\drivers\pbadrv.sys [2005-12-09 18816]
R2 ASFIPmon;Broadcom ASF IP Monitor;C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe [2006-03-17 65536]
R2 MsDtsServer;SQL Server Integration Services;C:\Program Files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe [2005-10-14 199384]
R2 MSExchangeMGMT;Microsoft Exchange Management;C:\Program Files\Exchsrvr\bin\exmgmt.exe [2003-06-24 3117568]
R2 ReportServer;SQL Server Reporting Services (MSSQLSERVER);C:\Program Files\Microsoft SQL Server\MSSQL.3\Reporting Services\ReportServer\bin\ReportingServicesService.exe [2005-10-14 14552]
R2 SSService;Visual SourceSafe LAN Service;C:\Program Files\Microsoft Visual SourceSafe\SSService.EXE [2007-11-21 329728]
R2 ufad-p2v;VMware Converter Service;C:\Program Files\VMware\VMware Converter\vmware-ufad.exe [2007-11-01 176128]
R2 vmserverdWin32;VMware Registration Service;C:\Program Files\VMware\VMware Server\vmserverdWin32.exe [2007-04-12 1646685]
R2 vstor2-p2v30;Vstor2 P2V30 Virtual Storage Driver;C:\Program Files\VMware\VMware Converter\vstor2-p2v30.sys [2007-11-01 19248]
R2 WGX;Extend WG Protocol Driver;C:\WINDOWS\system32\Drivers\WGX.SYS [2008-05-29 38248]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-09-02 23888]
S3 DSI_SiUSBXp_3_1;DSI_SiUSBXp_3_1;C:\WINDOWS\system32\drivers\DSI_SiUSBXp_3_1.sys [2007-09-06 14848]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2006-12-02 2805000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
MSConfigStartUp-OrderReminder - C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-09 08:03:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\msftesql]
"ImagePath"="\"C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe\" -s:MSSQL.2 -f:MSSQLSERVER"

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\vsdatant]
"ImagePath"="a"
.
———————— Other Running Processes ————————
.
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Wave Systems Corp\common\DataServer.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\OLAP\bin\msmdsrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
C:\Program Files\VMware\VMware Server\vmware-authd.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\searchindexer.exe
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\TechSmith\SnagIt 7\TscHelp.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SescLU.exe
.
**************************************************************************
.
Completion time: 2008-09-09 8:09:01 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-09 13:08:54
ComboFix2.txt 2008-09-05 18:04:21
ComboFix3.txt 2008-09-03 14:07:36
ComboFix4.txt 2008-09-02 14:53:35

Pre-Run: 31,127,457,792 bytes free
Post-Run: 31,118,774,272 bytes free

338 — E O F — 2008-09-09 12:53:20

Logfile of HijackThis v1.99.1
Scan saved at 08:12, on 2008-09-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\Wave Systems Corp\Common\DataServer.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft SQL Server\MSSQL.3\Reporting Services\ReportServer\bin\ReportingServicesService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
C:\Program Files\VMware\VMware Converter\vmware-ufad.exe
C:\Program Files\VMware\VMware Server\vmware-authd.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Exchsrvr\bin\exmgmt.exe
C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\TechSmith\SnagIt 7\SnagIt32.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
C:\Program Files\TechSmith\SnagIt 7\TSCHelp.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mgcsql/esynergy/docs/bp.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5061024
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = mgcisa:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.1.*;66.84.153.*;
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
O4 - Global Startup: SnagIt 7.lnk = C:\Program Files\TechSmith\SnagIt 7\SnagIt32.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://50.gmodules.com
O15 - Trusted Zone: http://53.gmodules.com
O15 - Trusted Zone: http://www.linkedin.com
O15 - Trusted Zone: http://*.mgc6
O15 - Trusted Zone: http://*.mgcmail2
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {0A2B8FD3-52A3-11D4-9E29-0001023AE3ED} (Crypto Class) - http://support.medgraphics.com/efrontoffic…marsFeather.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {210D0CBC-8B17-48D1-B294-1A338DD2EB3A} (VatCtrl Class) - http://70.88.61.157/VatDec.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {26774F3E-5F15-4883-8394-89146270A8C7} (SynergyOfficeAddin.Connect_Excel) - http://mgcsql/pilot/cab/SynergyOfficeAddin.CAB
O16 - DPF: {42D037E2-DECD-470C-B561-A18043C81B29} (Inter-Tel Unified Communicator Web Client) - http://66.84.153.196/UCROOT/WebCode/WebClient.cab
O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - https://www.microsoft.com/resources/virtual…iveXClient1.cab
O16 - DPF: {7C896371-4B7F-4B34-95B1-24851F5DED24} (Microsoft Virtual Server VMRC Control) - http://microsoft.granitepillar.com/vlatten…tiveXClient.cab
O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - https://transfers.ds.microsoft.com/FTM/Tran…ransferCtrl.cab
O16 - DPF: {8C41EB55-37B2-40CB-8942-F169CA06DB2F} (GPAuthorization Class) - http://microsoft.granitepillar.com/vlatten…d/gpconsole.cab
O16 - DPF: {A7B6FBFE-C894-4954-8377-D1CF19B4E07F} - http://uc.medgraphics.com/WCRS$/applets/OcxLink.cab
O16 - DPF: {B284ECAC-D46D-4354-B185-A5B06A01525D} (Inter-Tel Unified Communicator Administrator) - http://uc.medgraphics.com/UCROOT/WebCode/WebAdmin.cab
O16 - DPF: {BD324C84-E46E-11D3-83D0-00C04F4EB66B} (HTMLParser Class) - http://mgcsql/esynergy/cab/ebcasp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://exact.webex.com/client/v_mywebex-t2…bex/ieatgpc.cab
O16 - DPF: {F3C7C5EE-8BBA-4B6E-8147-3B315A41B85B} - http://uc.medgraphics.com/clientinstall/install.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mgccorp.int
O17 - HKLM\Software\..\Telephony: DomainName = mgccorp.int
O17 - HKLM\System\CCS\Services\Tcpip\..\{7BFF05B4-3A40-4742-99D9-977FAD477CBB}: NameServer = 172.16.0.12
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mgccorp.int
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = mgccorp.int
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = mgccorp.int
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - AppInit_DLLs: wxvault.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Broadcom ASF IP Monitor (ASFIPmon) - Unknown owner - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe" -service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SQL Server FullText Search (MSSQLSERVER) (msftesql) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe" -s:MSSQL.2 -f:MSSQLSERVER (file missing)
O23 - Service: SQL Server (MSSQLSERVER) (MSSQLSERVER) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe" -sMSSQLSERVER (file missing)
O23 - Service: SQL Server Analysis Services (MSSQLSERVER) (MSSQLServerOLAPService) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\OLAP\bin\msmdsrv.exe" -s "C:\Program Files\Microsoft SQL Server\MSSQL.1\OLAP\Config (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
O23 - Service: SQL Server Agent (MSSQLSERVER) (SQLSERVERAGENT) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\SQLAGENT90.EXE" -i MSSQLSERVER (file missing)
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
O23 - Service: NTRU Hybrid TSS v2.0.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
O23 - Service: VMware Converter Service (ufad-p2v) - Unknown owner - C:\Program Files\VMware\VMware Converter\vmware-ufad.exe" -d "C:\Program Files\VMware\VMware Converter\\" -s ufad-p2v.xml (file missing)
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware Registration Service (vmserverdWin32) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

LDTate

Post #12September 10, 2008, 12:36 AM UTC

Good job

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
- [external image: Posted Image]

LDTate

Post #13September 19, 2008, 8:30 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] HELP, GOOGLE SEARCHES ARE REDIRECTED

✨ Ask AI

Ask AI