ComboFix 08-07-28.1 - SHAHSH 2008-07-28 17:43:40.2 - NTFSx86 MINIMAL Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.357 [GMT -4:00] Running from: C:\Documents and Settings\SHAHSH\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\SHAHSH\Favorites\ImageMapper.exe C:\Documents and Settings\SHAHSH\g2mdlhlpx.exe C:\Documents and Settings\varsha\Application Data\macromedia\Flash Player\#SharedObjects\JJ9CQS24\interclick.com C:\Documents and Settings\varsha\Application Data\macromedia\Flash Player\#SharedObjects\JJ9CQS24\interclick.com\ud.sol C:\Documents and Settings\varsha\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com C:\Documents and Settings\varsha\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol C:\WINDOWS\Downloaded Program Files\Temp C:\WINDOWS\system32\69384.exe . ---- Previous Run ------- . C:\WINDOWS\system32\AutoRun.inf . ((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-28 ))))))))))))))))))))))))))))))) . 2008-07-28 10:59 . 2008-07-28 10:59 d-------- C:\Documents and Settings\LocalService\Application Data\HPAppData 2008-07-28 03:25 . 2008-07-28 03:25 d-------- C:\Program Files\Trend Micro 2008-07-28 02:55 . 2008-07-28 02:55 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-07-28 02:55 . 2008-07-28 02:55 d-------- C:\Documents and Settings\SHAHSH\Application Data\Malwarebytes 2008-07-28 02:55 . 2008-07-28 02:55 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-07-28 02:55 . 2008-07-23 20:09 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-07-28 02:55 . 2008-07-23 20:09 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-07-28 02:54 . 2008-07-28 02:54 d-------- C:\Program Files\Common Files\Download Manager 2008-07-27 00:59 . 2008-07-27 00:59 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-07-27 00:58 . 2008-07-27 00:58 d-------- C:\Program Files\SUPERAntiSpyware 2008-07-27 00:58 . 2008-07-27 00:58 d-------- C:\Documents and Settings\SHAHSH\Application Data\SUPERAntiSpyware.com 2008-07-26 22:07 . 2008-07-26 22:07 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-07-26 22:07 . 2008-07-26 22:07 1,409 --a------ C:\WINDOWS\QTFont.for 2008-07-16 18:19 . 2008-07-16 18:19 d-------- C:\Documents and Settings\varsha\Application Data\DellFaxCtr 2008-07-14 10:50 . 2008-07-14 11:45 d-------- C:\Linux 2008-07-12 23:52 . 2008-07-12 23:56 108,138 --a------ C:\WINDOWS\hpqins01.dat 2008-07-12 23:51 . 2008-07-11 17:40 147,671 --------- C:\WINDOWS\hpoins21.dat.temp 2008-07-12 23:51 . 2007-09-05 14:26 8,138 --------- C:\WINDOWS\hpomdl21.dat.temp 2008-07-12 17:01 . 2008-07-12 17:03 d-------- C:\Documents and Settings\SHAHSH\Application Data\DellFaxCtr 2008-07-12 17:00 . 2008-07-12 17:00 d-------- C:\Documents and Settings\All Users\Application Data\DellFaxCtr 2008-07-12 17:00 . 2006-04-24 14:58 339,968 --a------ C:\WINDOWS\system32\IMGMAN32.DLL 2008-07-12 17:00 . 2006-04-24 14:58 98,345 --a------ C:\WINDOWS\system32\IMHOST32.DLL 2008-07-12 17:00 . 2006-04-24 14:58 98,304 --a------ C:\WINDOWS\system32\IM31XPNG.DEL 2008-07-12 17:00 . 2006-04-24 14:58 69,632 --a------ C:\WINDOWS\system32\IM31XTIF.DEL 2008-07-12 17:00 . 2006-04-24 14:58 49,152 --a------ C:\WINDOWS\system32\IM31IMG.DIL 2008-07-12 17:00 . 2006-10-06 07:06 45,056 --a------ C:\WINDOWS\system32\DLPRMON.DLL 2008-07-12 17:00 . 2006-10-06 07:05 32,768 --a------ C:\WINDOWS\system32\DLPMONUI.DLL 2008-07-12 17:00 . 2008-07-12 17:01 10,209 --a------ C:\WINDOWS\system32\LexFiles.ulf 2008-07-12 16:59 . 2008-07-24 15:16 d-------- C:\Program Files\Dell PC Fax 2008-07-11 17:56 . 2008-07-11 17:56 0 --a------ C:\WINDOWS\hpqEmlSz.INI 2008-07-11 17:44 . 2008-07-11 17:56 d-------- C:\Documents and Settings\SHAHSH\Application Data\HP 2008-07-11 17:40 . 2008-07-11 17:40 d-------- C:\Documents and Settings\All Users\Application Data\WEBREG 2008-07-11 17:36 . 2008-07-13 11:27 d-------- C:\Documents and Settings\SHAHSH\Application Data\HPAppData 2008-07-11 17:36 . 2008-07-11 17:36 d-------- C:\Documents and Settings\All Users\Application Data\HPSSUPPLY 2008-07-11 17:33 . 2008-07-11 17:33 d-------- C:\Program Files\Common Files\HP 2008-07-11 17:33 . 2008-07-11 17:33 d-------- C:\Documents and Settings\All Users\Application Data\HP Product Assistant 2008-07-11 17:33 . 2008-07-11 17:56 d-------- C:\Documents and Settings\All Users\Application Data\HP 2008-07-11 17:32 . 2008-07-11 17:32 d-------- C:\Program Files\Common Files\Hewlett-Packard 2008-07-11 17:28 . 2007-05-02 04:56 954,368 -ra------ C:\WINDOWS\system32\hpotiop5.dll 2008-07-11 17:28 . 2007-05-02 05:01 675,840 -ra------ C:\WINDOWS\system32\hpowiax5.dll 2008-07-11 17:28 . 2007-03-08 00:20 364,544 -ra------ C:\WINDOWS\system32\hppldcoi.dll 2008-07-11 17:28 . 2007-03-08 00:20 309,760 -ra------ C:\WINDOWS\system32\difxapi.dll 2008-07-11 17:28 . 2007-05-02 05:00 303,104 -ra------ C:\WINDOWS\system32\hpovst12.dll 2008-07-11 17:28 . 2001-08-17 13:53 6,784 --a------ C:\WINDOWS\system32\drivers\serscan.sys 2008-07-11 17:28 . 2001-08-17 13:53 6,784 --a------ C:\WINDOWS\system32\dllcache\serscan.sys 2008-07-11 17:25 . 2008-07-11 17:26 d----c--- C:\WINDOWS\system32\DRVSTORE 2008-07-11 17:25 . 2008-07-11 17:36 d-------- C:\Program Files\HP 2008-07-11 17:21 . 2008-07-12 23:53 146,989 --a------ C:\WINDOWS\hpoins21.dat 2008-07-11 17:21 . 2007-09-05 14:26 8,138 --------- C:\WINDOWS\hpomdl21.dat 2008-07-11 13:08 . 2008-07-11 13:09 d-------- C:\Documents and Settings\SHAHSH\Application Data\webex 2008-06-30 12:42 . 2008-06-30 12:42 1,071 --a------ C:\WINDOWS\AWMODEM.INF . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-28 20:53 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-07-28 19:38 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-07-28 19:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee 2008-07-28 02:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-07-27 04:01 --------- d-----w C:\Program Files\Spyware Doctor 2008-07-17 00:05 --------- d-----w C:\Program Files\1 Click PC Fix 2008-07-12 21:09 --------- d-----w C:\Program Files\dl_Cats 2008-07-11 21:36 --------- d-----w C:\Program Files\Hewlett-Packard 2008-07-11 21:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Hewlett-Packard 2008-06-30 16:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip 2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 17:41 245,248 ------w C:\WINDOWS\system32\dllcache\mswsock.dll 2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\dllcache\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys 2008-06-18 00:38 --------- d-----w C:\Documents and Settings\SHAHSH\Application Data\Download Manager 2008-06-17 23:20 --------- d-----w C:\Documents and Settings\SHAHSH\Application Data\GARMIN 2008-06-17 23:19 --------- d-----w C:\Program Files\Garmin GPS Plugin 2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-12 04:11 --------- d-----w C:\Documents and Settings\SHAHSH\Application Data\U3 2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\dllcache\rmcast.sys 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll 2008-04-30 16:28 2,516 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2008-04-10 21:38 95 ----a-w C:\Documents and Settings\SHAHSH\mmgo.bat 2007-07-03 02:45 108 ----a-w C:\Documents and Settings\SHAHSH\go.bat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SmcService"="C:\PROGRA~1\Sygate\SSA\smc.exe" [2004-01-14 22:54 2344160] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-04-07 15:22 4730880] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SmartRAM"="C:\Program Files\IObit\Advanced WindowsCare V2\MemCleaner.exe" [2007-10-29 16:43 662016] "DLCXCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCXtime.dll" [2006-10-16 01:31 106496] "SmartDefrag"="C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" [2008-04-17 14:51 1870592] "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-03-11 21:34 49152] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-06-24 21:42 98304] "FaxCenterServer"="C:\Program Files\Dell PC Fax\fm3032.exe" [2006-11-03 17:09 312200] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2007-03-11 21:26:24 210520] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveSearch"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winwe30.sys] @="Driver" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC-Checkup] --a------ 2007-08-01 20:08 3965440 C:\Program Files\Speeditup Free\PCCheckUp\PCCheckUp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedItUpEX] --a------ 2007-08-25 05:05 2124800 C:\Program Files\Speeditup Free\SpeedItUp.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\WINDOWS\\system32\\mshta.exe"= "C:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Neoteris\\Secure Application Manager\\dsSamProxy.exe"= "C:\\Documents and Settings\\SHAHSH\\Application Data\\Juniper Networks\\Juniper Terminal Services Client\\dsTermServ.exe"= "C:\\WINDOWS\\system32\\dlcxcoms.exe"= "C:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe"= "C:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe"= "C:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"= "C:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"= "C:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe"= "C:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"= "C:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpoews01.exe"= "C:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "4100:UDP"= 4100:UDP:uPNP Router Control Port S0 Winwe30;Winwe30;C:\WINDOWS\system32\Drivers\Winwe30.sys [] S1 NEOFLTR_530_11159;Juniper Networks TDI Filter Driver (NEOFLTR_530_11159);C:\WINDOWS\system32\Drivers\NEOFLTR_530_11159.SYS [2006-09-15 01:10] S2 dlcx_device;dlcx_device;C:\WINDOWS\system32\dlcxcoms.exe [2006-11-03 17:07] S3 dsNcAdpt;Juniper Network Connect Adapter;C:\WINDOWS\system32\DRIVERS\dsNcAdpt.sys [] S3 ncvcp;Network Connect Virtual Com Port;C:\WINDOWS\system32\DRIVERS\nsvcp.sys [] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 HPService REG_MULTI_SZ HPSLPSVC hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] \Shell\AutoRun\command - E:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09d5eb55-4a3b-11dc-8ff7-00904b61f3da}] \Shell\AutoRun\command - E:\LaunchU3.exe -a . - - - - ORPHANS REMOVED - - - - HKLM-Run-SMrhc37jj0e5c7 - C:\Program Files\rhc37jj0e5c7\rhc37jj0e5c7.exe HKLM-Run-lphc77jj0e5c7 - C:\WINDOWS\system32\lphc77jj0e5c7.exe ShellExecuteHooks-{0cab0400-7395-11d0-a5e5-0020afe2fdd9} - qvphook.dll . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = hxxp://www.google.com/ R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=presario&pf=laptop R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s O8 -: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 -: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 -: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 -: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 -: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 -: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 -: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 -: Convert to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O8 -: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-28 17:46:28 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run DLCXCATS = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-07-28 17:47:41 ComboFix-quarantined-files.txt 2008-07-28 21:47:30 Pre-Run: 16,371,027,968 bytes free Post-Run: 16,366,301,184 bytes free 215 --- E O F --- 2008-07-09 14:00:08