No - I have just done a second search and confirm it is only in the one location.
No - I have just done a second search and confirm it is only in the one location.
- Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
Code:SRPeek:: c:\windows\system32\sfcfiles.dll- Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
- Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
- ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
- When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Microsoft MVP Consumer Security 2008-2011
Member of ASAP and UNITE since 2006
ComboFix 09-08-26.05 - home 08/26/2009 21:05.3.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1007.536 [GMT 1:00]
Running from: c:\documents and settings\home\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\home\Desktop\CFScript.txt
AV: PCguard Anti-Virus *On-access scanning disabled* (Updated) {5B5A3BD7-8573-4672-AEA8-C9BB713B6755}
FW: PCguard Firewall *disabled* {80593BF4-D969-4EC5-ADAE-A22F2DFC7A22}
.
((((((((((((((((((((((((( Files Created from 2009-07-26 to 2009-08-26 )))))))))))))))))))))))))))))))
.
2009-08-25 21:02 . 2009-08-25 21:02 -------- d-----w- c:\windows\LastGood
2009-08-25 19:47 . 2009-08-25 19:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Prism
2009-08-25 19:47 . 2004-06-28 02:08 16831 ----a-r- c:\windows\system32\CCU3C154.dll
2009-08-25 19:47 . 2004-06-17 11:59 225280 ----a-r- c:\windows\system32\CCU3C154.exe
2009-08-25 19:47 . 2004-05-18 03:27 386432 ----a-r- c:\windows\system32\drivers\3C154G72.sys
2009-08-25 19:46 . 2009-08-25 19:46 15781 ----a-w- c:\windows\system32\drivers\mdc8021x.sys
2009-08-25 19:46 . 2009-08-25 19:46 -------- d-----w- c:\program files\3Com
2009-08-23 16:07 . 2009-07-15 09:48 29000 ----a-w- c:\windows\system32\uxtuneup.dll
2009-08-23 16:07 . 2009-08-23 16:07 361288 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-08-23 14:32 . 2009-08-23 14:33 -------- d-----w- C:\!KillBox
2009-08-23 06:30 . 2009-08-23 06:32 -------- dc-h--w- c:\windows\ie8
2009-08-22 17:47 . 2009-08-22 17:47 -------- d-----w- c:\program files\ERUNT
2009-08-22 17:23 . 2008-06-19 16:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys
2009-08-22 17:20 . 2009-08-22 17:20 -------- d-----w- c:\program files\Panda Security
2009-08-22 17:12 . 2009-08-22 17:14 -------- d-----w- C:\rsit
2009-08-22 13:54 . 2008-08-28 12:16 71184 ----a-w- c:\windows\system32\drivers\DefragFS.sys
2009-08-22 13:54 . 2009-08-22 13:54 -------- d-----w- c:\program files\Raxco
2009-08-22 13:54 . 2009-08-22 13:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Raxco
2009-08-20 20:44 . 2009-08-20 20:44 -------- d-----w- c:\documents and settings\home\Local Settings\Application Data\Opera
2009-08-20 20:44 . 2009-08-21 19:19 -------- d-----w- c:\program files\Opera
2009-08-13 02:02 . 2008-04-14 00:42 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-08-12 19:59 . 2009-08-12 19:59 -------- d-----w- c:\documents and settings\All Users\Application Data\PassMark
2009-08-12 19:56 . 2009-08-21 19:26 -------- d-----w- c:\program files\WirelessMon
2009-08-08 06:27 . 2009-08-08 06:27 3942048 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-08-06 19:17 . 2009-08-06 19:17 152576 ----a-w- c:\documents and settings\home\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-01 20:43 . 2009-08-16 19:15 -------- d-----w- c:\documents and settings\home\Application Data\Any Video Converter
2009-08-01 20:43 . 2009-08-01 20:44 -------- d-----w- c:\program files\Any Video Converter
2009-07-30 05:10 . 2009-07-30 05:10 -------- d-----w- c:\documents and settings\home\DoctorWeb
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-26 20:21 . 2009-07-06 21:49 2044704 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-08-26 20:21 . 2009-07-06 21:49 36384 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-08-25 20:32 . 2009-07-06 21:49 2636 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-08-25 20:32 . 2009-07-06 21:49 21428 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-08-25 20:32 . 2009-04-24 17:02 -------- d-----w- c:\documents and settings\home\Application Data\Affinegy
2009-08-23 16:07 . 2009-07-07 20:38 604488 ----a-w- c:\windows\system32\TUProgSt.exe
2009-08-23 16:07 . 2009-07-07 20:37 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-08-23 15:02 . 2009-07-09 05:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-23 08:57 . 2009-04-18 11:35 -------- d-----w- c:\program files\Vuze
2009-08-22 17:13 . 2009-07-21 05:18 -------- d-----w- c:\program files\Trend Micro
2009-08-21 19:38 . 2009-07-09 05:16 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-21 19:20 . 2009-06-23 15:16 -------- d-----w- c:\program files\SWiSH Max2
2009-08-20 16:58 . 2009-04-18 11:39 -------- d-----w- c:\documents and settings\home\Application Data\Azureus
2009-08-16 19:38 . 2009-04-26 19:53 -------- d-----w- c:\documents and settings\home\Application Data\FileZilla
2009-08-13 02:08 . 2009-04-18 07:05 -------- d-----w- c:\program files\PeerGuardian2
2009-08-12 20:04 . 2009-05-23 15:03 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-08 06:27 . 2009-07-21 18:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-07 05:22 . 2009-04-20 17:25 724 ----a-w- c:\windows\aclockz6.dat
2009-08-06 19:22 . 2009-04-18 07:51 -------- d-----w- c:\program files\Java
2009-08-05 09:01 . 2008-04-14 00:42 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-03 12:36 . 2009-07-21 18:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 12:36 . 2009-07-21 18:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-25 04:23 . 2009-04-18 07:51 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-22 19:30 . 2009-07-12 19:24 -------- d-----w- c:\documents and settings\home\Application Data\SUPERAntiSpyware.com
2009-07-22 19:30 . 2009-07-12 19:24 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-07-21 18:27 . 2009-07-21 18:27 -------- d-----w- c:\documents and settings\home\Application Data\Malwarebytes
2009-07-21 18:27 . 2009-07-21 18:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-21 11:25 . 2009-07-20 23:10 2545 --s-a-w- c:\windows\system32\227948468.dat
2009-07-21 05:20 . 2009-05-02 04:39 -------- d-----w- c:\program files\Wisdom-soft ScreenHunter 5 Free
2009-07-21 05:20 . 2009-04-17 18:42 -------- d-----w- c:\program files\WYSIWYG Web Builder 5
2009-07-21 05:20 . 2009-04-15 04:32 -------- d-----w- c:\program files\Windows Media Connect 2
2009-07-21 05:20 . 2009-06-06 20:50 -------- d-----w- c:\program files\MagicMus
2009-07-21 05:20 . 2009-04-20 17:25 -------- d-----w- c:\program files\MemoKit
2009-07-18 20:22 . 2009-07-18 20:22 -------- d-----w- c:\documents and settings\All Users\Application Data\BVRP Software
2009-07-17 19:01 . 2008-04-14 00:41 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 22:43 . 2008-08-29 22:12 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-13 17:53 . 2009-07-13 17:53 192890 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\aeoffice.dll
2009-07-13 17:53 . 2009-07-13 17:53 1388918 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\aeheur.dll
2009-07-13 17:53 . 2009-07-13 17:53 115063 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\aehelp.dll
2009-07-13 17:53 . 2009-07-13 17:53 315764 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\aegen.dll
2009-07-13 17:53 . 2009-07-13 17:53 430452 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\aeemu.dll
2009-07-13 17:53 . 2009-07-13 17:53 172406 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\aecore.dll
2009-07-13 17:53 . 2009-07-13 17:53 53617 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\aebb.dll
2009-07-13 17:53 . 2009-07-13 17:53 2133360 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ToolBox\LT\HostFileEditor.exe
2009-07-12 19:24 . 2009-07-12 19:24 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-07-12 19:07 . 2009-04-24 16:57 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-11 18:51 . 2009-07-11 14:01 -------- d-----w- c:\documents and settings\All Users\Application Data\ParetoLogic
2009-07-11 06:47 . 2009-07-11 06:47 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-07-11 06:46 . 2009-07-11 06:46 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2009-07-09 17:52 . 2009-07-09 17:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-07-09 17:52 . 2009-07-09 17:52 314712 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2009-07-09 17:52 . 2009-07-09 19:33 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-07-09 17:52 . 2009-07-09 17:52 25440 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\savapibridge.dll
2009-07-09 17:52 . 2009-07-09 17:52 169312 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2009-07-09 17:52 . 2009-07-09 17:52 15688 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2009-07-09 17:52 . 2009-07-09 17:52 348496 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2009-07-09 17:52 . 2009-07-09 17:52 298336 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2009-07-09 17:52 . 2009-07-09 17:52 84832 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2009-07-09 17:50 . 2009-07-09 17:50 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-07-09 17:50 . 2009-07-09 17:50 -------- d-----w- c:\program files\Lavasoft
2009-07-08 05:01 . 2009-04-21 20:44 -------- d-----w- c:\program files\Yahoo!
2009-07-07 20:47 . 2009-05-23 14:53 -------- d-----w- c:\program files\Uniblue
2009-07-07 20:47 . 2009-05-23 15:01 -------- d-----w- c:\documents and settings\All Users\Application Data\DriverScanner
2009-07-07 20:47 . 2009-05-23 14:54 -------- d-----w- c:\documents and settings\home\Application Data\uniblue
2009-07-07 20:38 . 2009-07-07 20:38 -------- d-----w- c:\documents and settings\home\Application Data\TuneUp Software
2009-07-07 20:37 . 2009-07-07 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-07-07 20:37 . 2009-07-07 20:37 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-07-07 20:04 . 2009-06-23 11:07 -------- d-----w- c:\program files\SWiSHmax
2009-07-07 20:03 . 2009-04-21 20:47 -------- d-----w- c:\documents and settings\home\Application Data\Yahoo!
2009-07-07 20:03 . 2009-04-21 20:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-07-06 21:27 . 2009-07-06 21:16 -------- d-----w- c:\program files\Virgin Broadband
2009-07-06 21:26 . 2009-04-24 17:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Virgin Broadband
2009-07-05 20:22 . 2009-07-05 20:22 -------- d-----w- c:\documents and settings\home\Application Data\Apple Computer
2009-07-05 09:19 . 2009-07-05 09:19 0 ----a-w- c:\windows\nsreg.dat
2009-07-03 19:22 . 2009-04-18 07:35 -------- d-----w- c:\program files\FileZilla FTP Client
2009-07-03 17:09 . 2008-06-23 15:57 915456 ------w- c:\windows\system32\wininet.dll
2009-07-02 19:52 . 2009-07-02 19:52 -------- d-----w- c:\documents and settings\All Users\Application Data\hps
2009-07-02 18:24 . 2009-07-02 18:24 -------- d-----w- c:\program files\jessops
2009-06-30 19:12 . 2009-05-24 20:20 25512 ----a-w- c:\windows\system32\drivers\ggsemc.sys
2009-06-30 19:12 . 2009-05-24 20:20 13224 ----a-w- c:\windows\system32\drivers\ggflt.sys
2009-06-22 17:11 . 2009-04-15 05:44 88984 ----a-w- c:\documents and settings\home\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-16 14:36 . 2008-04-14 00:42 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2008-04-14 00:41 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-12 12:31 . 2008-04-14 00:42 80896 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2008-04-14 00:42 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:13 . 2008-04-14 00:41 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 08:19 . 2009-04-15 04:32 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2008-04-14 00:42 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-06 20:33 . 2009-04-18 07:51 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-06-03 19:09 . 2008-04-14 00:42 1291264 ----a-w- c:\windows\system32\quartz.dll
.
(((((((((((((((((((((((((((((((((((((((((( SR_Search ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
------- Sigcheck -------
[-] 2008-08-29 22:15 1614848 362BC5AF8EAF712832C58CC13AE05750 c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-08-25_17.19.50 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-14 00:42 . 2009-07-14 11:03 46080 c:\windows\system32\tzchange.exe
+ 2009-08-25 19:46 . 2009-08-25 19:46 1271808 c:\windows\Installer\28018c.msi
+ 2009-04-24 16:55 . 2009-08-25 19:45 3705344 c:\windows\Downloaded Installations\{FA159870-93D0-4CE5-AAE5-6BB2E4E998BE}\3Com OfficeConnect Wireless Utility.msi
- 2009-04-24 16:55 . 2009-04-24 16:55 3705344 c:\windows\Downloaded Installations\{FA159870-93D0-4CE5-AAE5-6BB2E4E998BE}\3Com OfficeConnect Wireless Utility.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-07-02 393216]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"TuneUp MemOptimizer"="c:\program files\TuneUp Utilities 2009\MemOptimizer.exe" [2009-07-16 163144]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VersatoMs"="c:\program files\MagicMus\MulMouse.exe" [2004-06-17 282624]
"Broadbandadvisor.exe"="c:\program files\Virgin Broadband\advisor\Broadbandadvisor.exe" [2009-05-27 2303216]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-07-09 520024]
"Wireless Manager"="c:\program files\Virgin Broadband Wireless\Wireless Manager.exe" [2008-05-26 585728]
"PRISMSVR.EXE"="c:\program files\3Com\3Com OfficeConnect Wireless Utility\3Com Wireless 11g PC Card\PRISMSVR.EXE" [2004-04-26 295001]
c:\documents and settings\home\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
3Com Wireless 11g PC Card.lnk - c:\program files\3Com\3Com OfficeConnect Wireless Utility\3Com Wireless 11g PC Card\Monitor.exe [2004-7-2 299008]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *\0lsdelete
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"Nitro PDF Printer Monitor"="c:\program files\Nitro PDF\Professional\NitroPDFPrinterMonitor.exe"
"S3hotkey"=S3hotkey.exe
"S3TRAY2"=S3tray2.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
"c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [7/9/2009 6:52 PM 64160]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [8/22/2009 6:23 PM 28544]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 10:34 PM 1029456]
R2 MUsbFltr;USB WTMouse Filter Service;c:\windows\system32\drivers\MUsbFltr.sys [6/6/2009 9:50 PM 6528]
R2 RadialpointSafeConnectAgent;Virgin Broadband PCguard SafeConnectAgent;c:\program files\Virgin Broadband\PCguard\SafeConnect\bin\SanaAgent.exe [11/14/2008 6:28 PM 4937752]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [7/7/2009 9:38 PM 604488]
R3 3C154G;3Com OfficeConnect 802.11g PC Card Driver;c:\windows\system32\drivers\3C154G72.sys [8/25/2009 8:47 PM 386432]
R3 CVIAAUD;Cnxt VIA 3D Environmental Audio;c:\windows\system32\drivers\cviaaud.sys [6/6/2009 9:48 PM 321472]
R3 CVIAHALA;CVIAHALA;c:\windows\system32\drivers\cviahal.sys [6/6/2009 9:48 PM 216608]
R3 HSFHWVIA;HSFHWVIA;c:\windows\system32\drivers\HSFHWVIA.sys [6/6/2009 9:49 PM 192768]
R3 Radialpoint Security Services;Virgin Broadband PCguard;c:\program files\Virgin Broadband\PCguard\RpsSecurityAwareR.exe [5/27/2009 1:10 PM 170736]
R3 RadialpointSafeConnectDriver;RadialpointSafeConnectDriver;c:\program files\Virgin Broadband\PCguard\SafeConnect\Driver\platform_XP\SafeConnectDriver.sys [11/14/2008 6:28 PM 161304]
R3 RadialpointSafeConnectFilter;RadialpointSafeConnectFilter;c:\program files\Virgin Broadband\PCguard\SafeConnect\Driver\platform_XP\SafeConnectFilter.sys [11/14/2008 6:28 PM 29720]
R3 RadialpointSafeConnectShim;RadialpointSafeConnectShim;c:\program files\Virgin Broadband\PCguard\SafeConnect\Driver\platform_XP\SafeConnectShim.sys [11/14/2008 6:28 PM 27376]
S2 AffinegyServiceAffinegyServiceAlerter;AffinegyService AffinegyServiceAffinegyServiceAlerter;c:\windows\TEMP\rdctgolvmt.exe service --> c:\windows\TEMP\rdctgolvmt.exe service [?]
S2 AffinegyServiceAlerter;AffinegyService AffinegyServiceAlerter;c:\windows\TEMP\pcmhfhurak.exe service --> c:\windows\TEMP\pcmhfhurak.exe service [?]
S2 kiqdb;kiqdb;c:\windows\system32\drivers\pkaj.sys --> c:\windows\system32\drivers\pkaj.sys [?]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [5/24/2009 9:20 PM 13224]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [5/8/2009 3:23 PM 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [5/8/2009 3:23 PM 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [5/8/2009 3:23 PM 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [5/8/2009 3:23 PM 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [5/8/2009 3:23 PM 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [5/8/2009 3:23 PM 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [5/8/2009 3:23 PM 115752]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [5/8/2009 3:23 PM 90408]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\drivers\s1018mdfl.sys [5/8/2009 3:23 PM 15016]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\drivers\s1018mdm.sys [5/8/2009 3:23 PM 122024]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1018mgmt.sys [5/8/2009 3:23 PM 115368]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1018nd5.sys [5/8/2009 3:23 PM 25768]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\drivers\s1018obex.sys [5/8/2009 3:23 PM 111784]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1018unic.sys [5/8/2009 3:23 PM 117544]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [4/23/2007 1:54 PM 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [4/23/2007 1:54 PM 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [4/23/2007 1:54 PM 108680]
S4 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe --> c:\program files\AskBarDis\bar\bin\AskService.exe [?]
S4 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe --> c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [?]
S4 PD91Agent;PD91Agent;c:\program files\Raxco\PerfectDisk2008\PD91Agent.exe [9/22/2008 4:58 PM 693512]
S4 PD91Engine;PD91Engine;c:\program files\Raxco\PerfectDisk2008\PD91Engine.exe [9/22/2008 4:58 PM 910600]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Nitro PDF Professional]
cscript //B "c:\program files\Nitro PDF\Professional\RemoveOldAddins.vbs"
.
Contents of the 'Scheduled Tasks' folder
2009-08-26 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-07-16 08:54]
2009-08-24 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 17:51]
2009-08-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2009-08-25 c:\windows\Tasks\User_Feed_Synchronization-{319BC319-DD29-46B2-AE61-ECC6F2186869}.job
- c:\windows\system32\msfeedssync.exe [2008-08-29 03:31]
.
.
------- Supplementary Scan -------
.
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab
FF - ProfilePath - c:\documents and settings\home\Application Data\Mozilla\Firefox\Profiles\k6bceon5.default\
FF - prefs.js: browser.startup.homepage - file:///C:/Documents%20and%20Settings/home/My%20Documents/homepage/Local%20Publish/index.html
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Virgin Broadband\advisor\nprpspa.dll
---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-26 21:21
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3196)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
Completion time: 2009-08-26 21:29
ComboFix-quarantined-files.txt 2009-08-26 20:29
ComboFix2.txt 2009-08-26 19:58
ComboFix3.txt 2009-08-25 17:28
Pre-Run: 68,911,489,024 bytes free
Post-Run: 68,897,652,736 bytes free
Current=3 Default=3 Failed=2 LastKnownGood=4 Sets=1,2,3,4
326 --- E O F --- 2009-08-26 02:00
OK, no copy of sfcfiles.dll in system restore.
Do you have windows cd handy?
Microsoft MVP Consumer Security 2008-2011
Member of ASAP and UNITE since 2006
I do not have the windows CD as it came pre-installed on my laptop.
You asked - "OK, no copy of sfcfiles.dll in system restore" - I did a 'search' of the C:\ drive and it only came up with the one occurrence. How do I check the system restore?
What is this sfcfiles.dll ..?
Combofix checked it for you already Are you maybe able to borrow windows CD from someone?
Here is some information about it; it is pretty important windows file which doesn't appear to be original one.
Microsoft MVP Consumer Security 2008-2011
Member of ASAP and UNITE since 2006
I will see if I can borrow one from work today. If they wont let me take the CD away with me, would it be sufficient to copy that particular file from the CD onto a memory stick..?
In theory yes but replacing it might not be that easy.
So CD is recommended option.
Microsoft MVP Consumer Security 2008-2011
Member of ASAP and UNITE since 2006
I could not get hold of a CD today, but I managed to find the original system restore discs. I think these are intended to rebuild the system but will reformat the hard drive.
Should I try and search the discs for the dll file?
You can, but problem might be that version doesn't match.
Microsoft MVP Consumer Security 2008-2011
Member of ASAP and UNITE since 2006