RR:
I agree.
Will do.
RF123
ComboFix 08-03-01 - Owner 2008-02-29 14:57:38.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.362 [GMT -7:00]
Running from: C:\Users\Owner\Desktop\fixing_user\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
D:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-02-01 to 2008-03-01 )))))))))))))))))))))))))))))))
.
2008-02-29 14:43 . 2006-11-02 02:44 320,000 --a------ C:\kmd.exe
2008-02-28 21:47 . 2008-02-28 21:47 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-24 12:54 . 2008-02-24 12:54 <DIR> d-------- C:\Program Files\MSECache
2008-02-17 10:04 . 2008-02-17 10:04 <DIR> d-------- C:\Users\Owner\AppData\Roaming\McAfee
2008-02-16 02:09 . 2008-01-09 22:50 1,244,672 --a------ C:\Windows\System32\mcmde.dll
2008-02-14 03:18 . 2008-02-14 03:18 194,560 --a------ C:\Windows\System32\WebClnt.dll
2008-02-14 03:18 . 2008-02-14 03:18 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
2008-02-14 03:10 . 2008-02-14 03:10 3,504,696 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-02-14 03:10 . 2008-02-14 03:10 3,470,392 --a------ C:\Windows\System32\ntoskrnl.exe
2008-02-14 03:10 . 2008-02-14 03:10 154,624 --a------ C:\Windows\System32\drivers\nwifi.sys
2008-02-14 03:10 . 2008-02-14 03:10 109,624 --a------ C:\Windows\System32\drivers\ataport.sys
2008-02-14 03:10 . 2008-02-14 03:10 45,112 --a------ C:\Windows\System32\drivers\pciidex.sys
2008-02-14 03:10 . 2008-02-14 03:10 21,560 --a------ C:\Windows\System32\drivers\atapi.sys
2008-02-14 03:10 . 2008-02-14 03:10 15,928 --a------ C:\Windows\System32\drivers\pciide.sys
2008-02-14 03:08 . 2008-02-14 03:08 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-14 03:08 . 2008-02-14 03:08 1,686,528 --a------ C:\Windows\System32\gameux.dll
2008-02-14 03:08 . 2008-02-14 03:08 803,328 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-02-14 03:08 . 2008-02-14 03:08 216,632 --a------ C:\Windows\System32\drivers\netio.sys
2008-02-14 03:08 . 2008-02-14 03:08 167,424 --a------ C:\Windows\System32\tcpipcfg.dll
2008-02-14 03:08 . 2008-02-14 03:08 24,064 --a------ C:\Windows\System32\netcfg.exe
2008-02-14 03:08 . 2008-02-14 03:08 22,016 --a------ C:\Windows\System32\netiougc.exe
2008-02-08 09:49 . 2008-02-08 09:49 <DIR> d-------- C:\Program Files\iTunes
2008-02-08 09:49 . 2008-02-08 09:49 <DIR> d-------- C:\Program Files\iPod
2008-02-08 09:47 . 2008-02-08 09:47 <DIR> d-------- C:\Program Files\Bonjour
2008-02-08 09:45 . 2008-02-08 09:46 <DIR> d-------- C:\Program Files\QuickTime
2008-02-01 11:11 . 2008-02-01 11:11 586,240 --a------ C:\Windows\WLXPGSS.SCR
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-29 14:13 --------- d-----w C:\Program Files\McAfee
2008-02-29 05:56 --------- d-----w C:\Program Files\Windows Sidebar
2008-02-29 05:55 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-02-29 05:55 --------- d-----w C:\Program Files\Windows Mail
2008-02-29 05:55 --------- d-----w C:\Program Files\Windows Journal
2008-02-29 05:55 --------- d-----w C:\Program Files\Windows Defender
2008-02-29 05:55 --------- d-----w C:\Program Files\Windows Calendar
2008-02-27 10:02 --------- d-----w C:\Program Files\Windows Live
2008-02-26 01:05 2,260 ----a-w C:\Users\Owner\AppData\Roaming\wklnhst.dat
2008-02-24 08:36 --------- d-----w C:\Users\Owner\AppData\Roaming\Image Zone Express
2008-02-17 17:05 --------- d-----w C:\ProgramData\McAfee
2008-02-14 19:07 --------- d-----w C:\ProgramData\Symantec
2008-02-14 10:40 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-02-14 10:09 --------- d-----w C:\ProgramData\Microsoft Help
2008-02-14 10:08 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-14 10:08 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-14 10:08 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-14 10:08 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-14 10:04 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-02-14 10:04 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-02-14 10:04 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-14 10:04 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-02-03 18:20 --------- d-----w C:\Users\Owner\AppData\Roaming\SiteAdvisor
2008-01-21 20:59 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-09 10:04 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys
2008-01-09 10:04 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys
2008-01-09 10:02 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2008-01-06 19:31 --------- d-----w C:\Users\Owner\AppData\Roaming\Apple Computer
2008-01-06 19:29 --------- d-----w C:\ProgramData\Apple Computer
2008-01-06 19:24 --------- d-----w C:\Program Files\Apple Software Update
2008-01-06 19:21 --------- d-----w C:\ProgramData\Apple
2008-01-06 19:21 --------- d-----w C:\Program Files\Common Files\Apple
2008-01-06 18:48 --------- d-----w C:\ProgramData\WildTangent
2008-01-06 18:48 --------- d-----w C:\Program Files\Gateway Games
2008-01-01 23:05 --------- d-----w C:\Users\Owner\AppData\Roaming\HP
2007-12-13 10:10 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2007-12-13 10:09 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2007-12-13 10:09 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2007-08-29 09:14 174 --sha-w C:\Program Files\desktop.ini
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 05:35 125440]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-04-11 19:41 1006264]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-09-29 02:09 815104]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-07-11 18:12 90112]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-07 22:28 1838592]
"NapsterShell"="C:\Program Files\Napster\napster.exe" [2006-09-06 13:12 323216]
"BigFix"="c:\program files\Bigfix\bigfix.exe" [2006-11-16 17:04 2348584]
"HostManager"="C:\Program Files\Common Files\AOL\1173654253\ee\AOLSoftware.exe" [2006-09-25 17:52 50736]
"RegistryMechanic"="" []
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2006-12-22 11:27 497176]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2006-12-22 11:28 756248]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 21:52 49152]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-04 14:18 267048]
"MSConfig"="C:\Windows\System32\msconfig.exe" [2006-11-02 02:45 222208]
C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-08-24 04:45:42 101784]
VZAccess Manager.lnk - C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe [2007-06-13 13:02:12 1685040]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
ExpressPLNRnote.lnk - C:\Program Files\Creative Home\Hallmark Card Studio Express\Planner\PLNRnote.exe [2006-01-16 14:28:06 28200]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 21:40:10 210520]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\syste m]
"EnableLUA"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcagent_exe]
--a------ 2007-08-04 01:33 582992 C:\Program Files\McAfee.com\Agent\mcagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteAdvisor]
--a------ 2006-10-18 09:14 35928 C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2100950283-1507416480-3796808343-1000]
"EnableNotificationsRef"=dword:00000002
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2100950283-1507416480-3796808343-500]
"EnableNotificationsRef"=dword:00000002
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{577D95F8-7467-42D9-AFCE-68E9BC2FB707}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{A3021845-8C7F-4D4E-9458-C8234775F0FB}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{F6164E14-F363-40BA-87AC-CC824E1CE59D}"= UDP:C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:AOL Connectivity Service Dialer
"{874D59BF-AEDA-4C61-9740-88C1E7AB1429}"= TCP:C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:AOL Connectivity Service Dialer
"{8F8A9C61-1193-49CC-A4C0-CF064A3037F0}"= UDP:C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:AOL Connectivity Service
"{FCCDF6B8-42F3-471F-A66B-48DA59F98872}"= TCP:C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:AOL Connectivity Service
"{11439E11-3C9E-41D6-A343-CF41CE018342}"= UDP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{11AD881E-4514-4D8C-8DAD-D4E2C19FD7D7}"= TCP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{0F06526C-9093-4E2F-8D08-2E1E60CA77BA}"= UDP:C:\Windows\System32\lxcycoms.exe:Lexmark Communications System
"{3B16484E-4EEC-486F-8FE5-0233E774EEBD}"= TCP:C:\Windows\System32\lxcycoms.exe:Lexmark Communications System
"{49A634A7-C1AD-48BC-AA04-1F6834D8723B}"= UDP:C:\Program Files\Lexmark 3400 Series\lxcymon.exe

evice Monitor
"{D35C7597-588F-4FD0-A9FC-D8A836C02DB4}"= TCP:C:\Program Files\Lexmark 3400 Series\lxcymon.exe

evice Monitor
"{0B70C6A5-979F-473C-BC11-10608777D70C}"= UDP:C:\Program Files\Lexmark 3400 Series\lxcyaiox.exe:All In One Center
"{FE581E58-15B3-4C7B-8669-8F484E02019B}"= TCP:C:\Program Files\Lexmark 3400 Series\lxcyaiox.exe:All In One Center
"{9524B698-228A-4111-8441-52535B588AD3}"= UDP:C:\Program Files\TurboTax\Deluxe 2006\32bit\ttax.exe:TurboTax
"{3727D4D8-BAED-410E-8640-2957F5378283}"= TCP:C:\Program Files\TurboTax\Deluxe 2006\32bit\ttax.exe:TurboTax
"{95A61AC4-A67B-4E93-859B-2F91FEA22C1F}"= UDP:C:\Program Files\TurboTax\Deluxe 2006\32bit\updatemgr.exe:TurboTax Update Manager
"{FE3CB136-2A1E-45BB-AD0D-FC0D89654736}"= TCP:C:\Program Files\TurboTax\Deluxe 2006\32bit\updatemgr.exe:TurboTax Update Manager
"{B5AE1AED-63EF-4C74-925E-1329E6816E19}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{82CADD69-FDF1-4554-8ECA-D563FE8FB541}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{947CD4E0-7878-4C01-937D-AE9634D39266}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{11CC13FA-73BF-47D1-AD5C-C6959B69E742}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"TCP Query User{EAF2AB9E-5989-41F9-8ECA-8A33835F3180}C:\program files\yahoo!\messenger\yahoomessenger.exe"= UDP:C:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger|Desc=Yahoo! Messenger
"UDP Query User{CA7D2FA3-416C-4E63-AC2D-E4BB02D03D65}C:\program files\yahoo!\messenger\yahoomessenger.exe"= TCP:C:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger|Desc=Yahoo! Messenger
"TCP Query User{50111BB1-81C5-4F0C-B380-11F9629C3CFC}C:\users\owner\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe"= UDP:C:\users\owner\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe:yahoo.messenger.ymapp.exe|Desc=yahoo.messen ger.ymapp.exe
"UDP Query User{EB8E2A83-9189-4F98-BFC0-2997E5904FCE}C:\users\owner\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe"= TCP:C:\users\owner\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe:yahoo.messenger.ymapp.exe|Desc=yahoo.messen ger.ymapp.exe
"{9376DD04-68D5-4F6C-84C0-77A3E0B971DD}"= UDP:C:\Windows\System32\lxcycoms.exe:Lexmark Communications System
"{58A6805E-604D-4005-A4FB-7CA7EEE89275}"= TCP:C:\Windows\System32\lxcycoms.exe:Lexmark Communications System
"{3D4DA707-1958-41C1-8BAA-4D7FF0731FCF}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)|Edge=TRUE|
"{B4633754-CD6D-4DFB-A0C9-503D29567E8C}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{8287BA31-0B89-47C9-B392-9CCDFA09AD59}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{E99D78A9-C0FF-461D-8444-A6DCDED6ADA2}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{ED8E38C0-C543-4A75-B0BC-4511D1DD488D}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)|Edge=TRUE|
"{F8A8D1FB-89C0-421D-8061-DE2E0A5A69D4}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{EF9730DC-09A7-49BE-9462-A00CE777F0B9}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{1AEC8066-6035-4178-BDC4-4F600B2ACDC4}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{82B89082-DC38-48CD-9206-ED10EC0904C6}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\S tatic\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
R3 NWADI;NWADI Bus Enumerator;C:\Windows\system32\DRIVERS\NWADIenum.sys [2007-04-19 10:09]
R3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-01-25 20:19]
R3 RTL85n86;Realtek 8180/8185 Extensible 802.11 Wireless Device Driver;C:\Windows\system32\DRIVERS\RTL85n86.sys [2007-03-12 16:49]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-02 00:30]
S3 NETw2v32;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows Vista;C:\Windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 00:30]
S4 0018781204294438mcinstcleanup;McAfee Application Installer Cleanup (0018781204294438);C:\Windows\TEMP\
001878~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini []
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
"2008-02-29 21:23:02 C:\Windows\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-01-15 09:29:54 C:\Windows\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-02-01 08:00:06 C:\Windows\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-03-01 15:02:58
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-03-01 15:04:21
ComboFix-quarantined-files.txt 2008-03-01 22:04:14
.
2008-02-27 10:02:25 --- E O F ---