ComboFix 08-07-26.1 - joal 2008-07-26 20:02:21.12 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1643 [GMT -4:00] Running from: C:\Documents and Settings\joal\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\joal\Application Data\macromedia\Flash Player\#SharedObjects\KJ5NPUDU\interclick.com C:\Documents and Settings\joal\Application Data\macromedia\Flash Player\#SharedObjects\KJ5NPUDU\interclick.com\ud.sol C:\Documents and Settings\joal\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com C:\Documents and Settings\joal\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol . ((((((((((((((((((((((((( Files Created from 2008-06-27 to 2008-07-27 ))))))))))))))))))))))))))))))) . 2008-07-23 19:07 . 2008-01-06 12:32 d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer 2008-07-23 19:07 . 2008-07-23 19:07 d-------- C:\Documents and Settings\Administrator 2008-07-22 01:58 . 2008-07-22 01:58 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-07-22 01:58 . 2008-07-22 01:58 d-------- C:\Documents and Settings\joal\Application Data\Malwarebytes 2008-07-22 01:58 . 2008-07-22 01:58 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-07-22 01:58 . 2008-07-20 20:21 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-07-22 01:58 . 2008-07-20 20:21 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-07-21 12:46 . 2008-07-21 12:46 d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-07-21 12:46 . 2008-07-21 12:46 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-07-20 13:09 . 2008-07-20 13:09 d-------- C:\_OTMoveIt 2008-07-19 14:20 . 2008-07-19 14:20 d-------- C:\Deckard 2008-07-18 22:45 . 2008-07-19 13:08 d-------- C:\WINDOWS\SxsCaPendDel 2008-07-18 20:32 . 2008-07-18 20:32 3,568 --a------ C:\WINDOWS\system32\tmp.reg 2008-07-18 17:57 . 2008-07-19 14:13 d-------- C:\VundoFix Backups 2008-07-13 18:56 . 2008-07-16 00:29 d-------- C:\Program Files\iTunes 2008-07-13 18:56 . 2008-07-13 18:56 d-------- C:\Program Files\iPod 2008-07-13 18:55 . 2008-07-13 18:55 d-------- C:\Program Files\Apple Software Update 2008-07-05 18:24 . 2008-07-24 14:24 d-------- C:\Program Files\Windows Live Safety Center . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-26 23:58 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-07-26 23:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-07-25 18:30 --------- d-----w C:\Documents and Settings\joal\Application Data\LimeWire 2008-07-25 04:49 --------- d-----w C:\Documents and Settings\joal\Application Data\IceChat 2008-07-23 07:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-07-23 03:28 --------- d-----w C:\Program Files\ZillaTube 2008-07-19 04:41 --------- d-----w C:\Program Files\Bonjour 2008-07-18 23:14 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-07-16 04:29 --------- d-----w C:\Program Files\Last.fm 2008-07-13 15:37 --------- d-----w C:\Program Files\Creative 2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-15 03:05 --------- d-----w C:\Program Files\QuickTime 2008-06-14 16:53 --------- d-----w C:\Program Files\Java 2008-06-14 16:52 --------- d-----w C:\Program Files\Common Files\Java 2008-06-14 16:47 --------- d-----w C:\Program Files\Viewpoint 2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-12 22:22 --------- d-----w C:\Documents and Settings\joal\Application Data\U3 2008-06-12 22:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee 2008-06-12 21:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-12 03:26 --------- d-----w C:\Program Files\DivX 2008-06-07 04:39 --------- d-----w C:\Documents and Settings\joal\Application Data\DivX 2008-05-31 02:58 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-05-31 02:58 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL 2008-05-31 02:58 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-05-31 02:58 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-05-31 02:58 --------- d-----w C:\Program Files\Symantec 2008-05-22 22:22 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll 2008-05-22 22:22 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe 2008-05-22 22:22 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe 2008-05-22 22:19 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2008-05-11 02:00 70,072 ----a-w C:\Documents and Settings\joal\Application Data\GDIPFONTCACHEV1.DAT 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll . ((((((((((((((((((((((((((((( snapshot@2008-07-21_ 2.53.50.60 ))))))))))))))))))))))))))))))))))))))))) . + 2006-10-27 01:55:38 138,024 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.4518\IMPMAIL.DLL + 2006-10-27 20:16:36 46,864 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.4518\OUTLRPC.DLL - 2008-07-09 06:59:42 1,165,584 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\accicons.exe + 2008-07-23 07:23:54 1,165,584 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\accicons.exe - 2008-07-09 06:59:42 20,240 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\cagicon.exe + 2008-07-23 07:23:55 20,240 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\cagicon.exe - 2008-07-09 06:59:42 159,504 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\inficon.exe + 2008-07-23 07:23:54 159,504 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\inficon.exe - 2008-07-09 06:59:42 217,864 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\misc.exe + 2008-07-23 07:23:55 217,864 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\misc.exe - 2008-07-09 06:59:42 18,704 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\mspicons.exe + 2008-07-23 07:23:55 18,704 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\mspicons.exe - 2008-07-09 06:59:43 35,088 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\oisicon.exe + 2008-07-23 07:23:55 35,088 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\oisicon.exe - 2008-07-09 06:59:42 845,584 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\outicon.exe + 2008-07-23 07:23:55 845,584 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\outicon.exe - 2008-07-09 06:59:42 922,384 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pptico.exe + 2008-07-23 07:23:55 922,384 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pptico.exe - 2008-07-09 06:59:42 272,648 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pubs.exe + 2008-07-23 07:23:55 272,648 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pubs.exe - 2008-07-09 06:59:42 888,080 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\wordicon.exe + 2008-07-23 07:23:55 888,080 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\wordicon.exe - 2008-07-09 06:59:42 1,172,240 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\xlicons.exe + 2008-07-23 07:23:54 1,172,240 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\xlicons.exe + 2005-05-24 16:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll + 2007-08-29 19:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe + 2007-08-29 19:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll - 2008-04-29 20:52:52 40,836 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-07-21 06:57:42 40,836 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-04-29 20:52:52 314,508 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-07-21 06:57:42 314,508 ----a-w C:\WINDOWS\system32\perfh009.dat . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AIM"="C:\Program Files\AIM\aim.exe" [2006-08-01 16:35 67112] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360] "AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 11:37 2321600] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 02:59 115816] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792] "LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 02:12 488984] "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 02:13 774168] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 18:38 583048] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064] "SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 18:20 339968 C:\WINDOWS\stsystra.exe] C:\Documents and Settings\joal\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664] Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2008-01-06 13:24:21 106496] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\AIM\\aim.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\Program Files\\IceChat7\\IceChat7.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= *Newly Created Service* - COMHOST . Contents of the 'Scheduled Tasks' folder 2008-07-25 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - s!:C:\Program Files\Apple Software Update\SoftwareUpdate.exe-taskSYSTEM0 [] . . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = hxxp://www.google.com/ O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-26 21:35:27 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-07-26 22:47:05 ComboFix-quarantined-files.txt 2008-07-27 02:44:51 ComboFix2.txt 2008-07-23 01:59:19 ComboFix3.txt 2008-07-22 22:59:19 ComboFix4.txt 2008-07-22 21:19:41 ComboFix5.txt 2008-07-27 00:01:40 Pre-Run: 95,189,839,872 bytes free Post-Run: 95,298,162,688 bytes free 178 --- E O F --- 2008-07-23 07:23:59