ComboFix 11-06-01.04 - Michael Thompson 06/01/2011 16:19:30.1.1 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2039.1174 [GMT -5:00] Running from: c:\documents and settings\Michael Thompson\Desktop\ComboFix.exe AV: Norton Security Suite *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton Security Suite *Disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} . WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat c:\documents and settings\All Users\Application Data\vlc-1.0.0-win32.exe c:\documents and settings\All Users\Application Data\vlc-1.0.1-win32.exe c:\documents and settings\All Users\Application Data\vlc-1.0.5-win32.exe c:\documents and settings\All Users\Application Data\vlc-1.1.5-win32.exe c:\documents and settings\Michael Thompson\g2mdlhlpx.exe c:\documents and settings\Michael Thompson\GoToAssistDownloadHelper.exe c:\windows\system32\bszip.dll c:\windows\system32\Thumbs.db . ----- BITS: Possible infected sites ----- . hxxp://buy-download.norton.com . ((((((((((((((((((((((((( Files Created from 2011-05-01 to 2011-06-01 ))))))))))))))))))))))))))))))) . . 2011-06-01 19:35 . 2011-06-01 19:35 -------- d-----w- c:\program files\Hitman Pro 3.5 2011-06-01 18:50 . 2011-06-01 19:35 17480 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys 2011-06-01 18:49 . 2011-06-01 19:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Hitman Pro 2011-06-01 18:04 . 2011-06-01 18:04 -------- d-----w- c:\documents and settings\Michael Thompson\Local Settings\Application Data\Symantec 2011-06-01 14:12 . 2011-06-01 14:12 -------- d-----w- C:\Users 2011-06-01 14:09 . 2011-06-01 14:09 -------- d-----w- c:\program files\Common Files\xing shared 2011-06-01 14:03 . 2011-06-01 14:03 -------- d-----w- c:\program files\iPod 2011-06-01 14:03 . 2011-06-01 14:04 -------- d-----w- c:\program files\iTunes 2011-06-01 14:02 . 2011-06-01 14:02 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin7.dll 2011-06-01 14:02 . 2011-06-01 14:02 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin6.dll 2011-06-01 14:02 . 2011-06-01 14:02 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin5.dll 2011-06-01 14:02 . 2011-06-01 14:02 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin4.dll 2011-06-01 14:02 . 2011-06-01 14:02 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin3.dll 2011-06-01 14:02 . 2011-06-01 14:02 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin2.dll 2011-06-01 14:02 . 2011-06-01 14:02 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin.dll 2011-06-01 14:01 . 2011-06-01 14:02 -------- d-----w- c:\program files\QuickTime 2011-06-01 13:59 . 2011-06-01 13:59 -------- d-----w- c:\program files\Apple Software Update 2011-06-01 13:56 . 2011-06-01 13:56 -------- d-----w- c:\program files\Bonjour 2011-06-01 13:53 . 2011-06-01 13:53 -------- d-----w- c:\program files\FileHippo.com 2011-06-01 12:54 . 2011-06-01 12:56 -------- d-----w- C:\bd_logs 2011-06-01 12:14 . 2011-06-01 11:21 16432 ----a-w- c:\windows\system32\lsdelete.exe 2011-06-01 10:40 . 2011-06-01 10:41 -------- d-----w- c:\program files\SUPERAntiSpyware 2011-06-01 02:51 . 2011-06-01 11:21 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys 2011-06-01 00:48 . 2011-06-01 00:48 -------- d-----w- c:\program files\Common Files\Adobe AIR 2011-06-01 00:09 . 2011-06-01 00:09 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-05-31 21:29 . 2011-02-22 23:06 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll 2011-05-31 21:01 . 2011-05-31 21:09 -------- d-----w- c:\windows\system32\drivers\N360\0403000.005 2011-05-17 11:46 . 2011-05-17 11:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype Extras 2011-05-09 20:44 . 2011-05-09 20:46 -------- d-----w- c:\documents and settings\Michael Thompson\Application Data\Inbox Toolbar . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-06-01 14:09 . 2011-04-26 05:58 348160 ----a-w- c:\windows\system32\msvcr71.dll 2011-06-01 14:09 . 2003-09-16 15:07 499712 ----a-w- c:\windows\system32\msvcp71.dll 2011-05-29 14:11 . 2008-10-09 20:34 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-05-29 14:11 . 2008-10-09 20:34 22712 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-04-14 10:07 . 2010-05-10 00:33 472808 ----a-w- c:\windows\system32\deployJava1.dll 2011-04-14 07:40 . 2010-05-10 00:33 73728 ----a-w- c:\windows\system32\javacpl.cpl 2011-04-06 21:20 . 2011-04-06 21:20 91424 ----a-w- c:\windows\system32\dnssd.dll 2011-04-06 21:20 . 2011-04-06 21:20 197920 ----a-w- c:\windows\system32\dnssdX.dll 2011-04-06 21:20 . 2011-04-06 21:20 107808 ----a-w- c:\windows\system32\dns-sd.exe 2011-03-11 14:10 . 2004-08-10 17:50 471552 ----a-w- c:\windows\apppatch\aclayers.dll 2011-03-07 05:33 . 2004-08-10 18:02 692736 ----a-w- c:\windows\system32\inetcomm.dll 2011-03-04 06:37 . 2004-08-10 17:51 420864 ----a-w- c:\windows\system32\vbscript.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 94208 ------w- c:\documents and settings\Michael Thompson\Application Data\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 94208 ------w- c:\documents and settings\Michael Thompson\Application Data\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 94208 ------w- c:\documents and settings\Michael Thompson\Application Data\Dropbox\bin\DropboxExt.14.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784] "PlaxoUpdate"="c:\documents and settings\Michael Thompson\Local Settings\Application Data\Plaxo\3.26.0.13\PlaxoHelper_en.exe" [2011-04-29 834952] "PlaxoSysTray"="c:\documents and settings\Michael Thompson\Local Settings\Application Data\Plaxo\3.26.0.13\PlaxoSysTray.exe" [2011-04-29 15752] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-05-27 15147400] "NortonUpdateAgent"="c:\documents and settings\All Users\Application Data\Norton\NUA.exe" [2011-04-05 2692024] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128] "PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816] "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248] "MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-17 135168] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920] "StatusClient"="c:\program files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2002-12-16 36864] "TomcatStartup"="c:\program files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe" [2003-04-01 155648] "mmtask"="c:\program files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2006-01-17 53248] "igfxtray"="c:\windows\system32\igfxtray.exe" [2006-06-06 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-06-06 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2006-06-06 118784] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-27 421160] . c:\documents and settings\Michael Thompson\Start Menu\Programs\Startup\ Dropbox.lnk - c:\documents and settings\Michael Thompson\Application Data\Dropbox\bin\Dropbox.exe [2011-5-25 24176560] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [N/A] Philips FunCam Monitor.lnk - c:\program files\Philips Photo Manager\FunCam\Philips FunCam Monitor.exe [2005-10-20 192512] QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2009-9-16 972064] VPN Client.lnk - c:\windows\Installer\{14FCFE7C-AB86-428A-9D2E-BFB6F5A7AA6E}\Icon3E5562ED7.ico [2009-3-6 6144] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist] 2009-03-07 16:44 10536 ------w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0autocheck lsdelete\0lsdelete . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Intuit\\QuickBooks 2005\\QBDBMgrN.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\dlbtcoms.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= . R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0403000.005\symds.sys [5/31/2011 4:04 PM 328752] R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0403000.005\symefa.sys [5/31/2011 4:04 PM 173104] R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20110518.001\BHDrvx86.sys [5/18/2011 6:47 PM 802936] R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0403000.005\cchpx86.sys [5/31/2011 4:04 PM 501888] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 1:25 PM 12872] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 1:41 PM 67656] R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0403000.005\ironx86.sys [5/31/2011 4:04 PM 116784] R2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\4.3.0.5\ccsvchst.exe [5/31/2011 4:02 PM 126392] R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20110527.001\IDSXpx86.sys [6/1/2011 1:11 PM 341944] S3 DCALEXICO;DCALEXICO;c:\windows\system32\drivers\DCalexico.sys --> c:\windows\system32\drivers\DCalexico.sys [?] S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [4/29/2011 12:11 PM 2151128] S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [4/29/2011 12:11 PM 15232] S3 SNDFCAM;Philips FunCam;c:\windows\system32\drivers\sndfcam.sys [10/20/2005 2:28 PM 219008] S3 SPCP825K;Sunplus Serial port driver;c:\windows\system32\DRIVERS\SPCP825K.sys --> c:\windows\system32\DRIVERS\SPCP825K.sys [?] . --- Other Services/Drivers In Memory --- . *NewlyCreated* - ERASERUTILDRV11110 *Deregistered* - EraserUtilDrv11110 *Deregistered* - MBAMSwissArmy . Contents of the 'Scheduled Tasks' folder . 2011-06-01 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2011-04-29 09:11] . 2011-06-01 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 16:50] . 2011-06-01 c:\windows\Tasks\CCleaner.job - c:\progra~1\CCleaner\ccleaner.exe [2011-05-25 19:55] . 2010-05-17 c:\windows\Tasks\Mike's Weekly Backup.job - c:\windows\system32\ntbackup.exe [2001-06-28 00:29] . 2011-06-01 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-734979710-210380571-2544208294-1006.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 15:47] . 2011-06-01 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-734979710-210380571-2544208294-1006.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 15:47] . 2011-06-01 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job - c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2006-03-09 21:31] . 2011-06-01 c:\windows\Tasks\Spybot - Search & Destroy Updater - Scheduled Task.job - c:\program files\Spybot - Search & Destroy\SDUpdate.exe [2008-02-09 21:31] . 2011-06-01 c:\windows\Tasks\User_Feed_Synchronization-{DF82C356-340D-4B93-AB21-FF86D987764B}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 09:31] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.comcast.net/mycomcast/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html uInternet Settings,ProxyOverride = ;*.local uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/ymj/*http://www.yahoo.com IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html TCP: DhcpNameServer = 8.8.4.4 208.67.222.222 68.87.72.134 DPF: {FFFDF6F2-F7BC-4B90-B789-CB7BBDA13AD6} - hxxp://eshare.hpphoto.com/Download/HPeServicesLocalPrint.CAB . - - - - ORPHANS REMOVED - - - - . WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file) HKCU-Run-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe SafeBoot-mcmscsvc SafeBoot-MCODS AddRemove-Plaxo - c:\documents and settings\Michael Thompson\Local Settings\Application Data\Plaxo\3.27.0.12\uninstall.exe AddRemove-WebCyberCoach_wtrb - c:\program files\WebCyberCoach\b_Dell\WCC_Wipe.exe WebCyberCoach ext\wtrb . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-06-01 16:27 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360] "ImagePath"="\"c:\program files\Norton Security Suite\Engine\4.3.0.5\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\4.3.0.5\diMaster.dll\" /prefetch:1" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters] "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\ . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'winlogon.exe'(1252) c:\program files\SUPERAntiSpyware\SASWINLO.DLL c:\windows\system32\WININET.dll c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll . Completion time: 2011-06-01 16:30:43 ComboFix-quarantined-files.txt 2011-06-01 21:30 . Pre-Run: 188,304,949,248 bytes free Post-Run: 188,350,816,256 bytes free . - - End Of File - - 9FACFE404B35D17A490852EB73D70F40