Hi Blade,
I was able to run combofix using the .bat file, excellent
It cleared out the java files and generated the following report.
*******************************************
ComboFix 09-09-16.02 - Dave 09/17/2009 3:14.3.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.237 [GMT -7:00]
Running from: c:\documents and settings\Dave\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Dave\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
* Created a new restore point
FILE ::
"c:\documents and settings\Dave\Application Data\Sun\Java\Deployment\cache\6.0\16\78fcee10-17cc9737"
"c:\documents and settings\Dave\Application Data\Sun\Java\Deployment\cache\6.0\38\67df4166-67463fc4"
"c:\documents and settings\Dave\Application Data\Sun\Java\Deployment\cache\6.0\49\6b800f31-3f5a9be9"
"c:\documents and settings\Dave\Application Data\Sun\Java\Deployment\cache\6.0\60\59af077c-4aa1c742"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Dave\Application Data\Sun\Java\Deployment\cache\6.0\16\78fcee10-17cc9737
c:\documents and settings\Dave\Application Data\Sun\Java\Deployment\cache\6.0\38\67df4166-67463fc4
c:\documents and settings\Dave\Application Data\Sun\Java\Deployment\cache\6.0\49\6b800f31-3f5a9be9
c:\documents and settings\Dave\Application Data\Sun\Java\Deployment\cache\6.0\60\59af077c-4aa1c742
.
((((((((((((((((((((((((( Files Created from 2009-08-17 to 2009-09-17 )))))))))))))))))))))))))))))))
.
2009-09-15 18:44 . 2009-09-15 18:44 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-15 18:44 . 2009-09-15 18:44 -------- d-----w- c:\program files\Java
2009-09-11 21:01 . 2009-09-11 21:01 -------- d-----w- c:\program files\trend micro
2009-09-11 21:01 . 2009-09-11 21:02 -------- d-----w- C:\rsit
2009-08-31 21:57 . 2009-08-31 21:57 -------- d-----w- c:\documents and settings\Dave\Application Data\Auslogics
2009-08-31 21:57 . 2009-08-31 21:57 -------- d-----w- c:\program files\Auslogics
2009-08-31 21:02 . 2009-03-30 17:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-08-31 21:02 . 2009-02-13 19:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-08-31 21:02 . 2009-02-13 19:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-08-31 21:01 . 2009-08-31 21:01 -------- d-----w- c:\program files\Avira
2009-08-31 21:01 . 2009-08-31 21:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-08-31 19:09 . 2009-09-17 00:07 -------- d-----w- c:\program files\Wise Disk Cleaner
2009-08-27 17:25 . 2009-08-27 17:25 -------- d-----w- c:\documents and settings\Dave\Application Data\Uniblue
2009-08-24 07:00 . 2009-08-24 07:00 -------- d-----w- c:\windows\ServicePackFiles
2009-08-24 06:46 . 2009-08-24 06:56 -------- d-----w- c:\windows\system32\CatRoot_bak
2009-08-20 23:52 . 2008-06-13 13:10 272128 ------w- c:\windows\system32\drivers\bthport.sys
2009-08-20 23:52 . 2008-06-13 13:10 272128 ------w- c:\windows\system32\dllcache\bthport.sys
2009-08-20 23:47 . 2008-05-01 14:30 331776 ------w- c:\windows\system32\dllcache\msadce.dll
2009-08-20 23:45 . 2009-06-05 07:42 655872 ------w- c:\windows\system32\dllcache\mstscax.dll
2009-08-20 23:44 . 2008-04-21 10:02 215552 ------w- c:\windows\system32\dllcache\wordpad.exe
2009-08-20 22:49 . 2009-07-28 23:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-20 22:25 . 2002-01-05 12:40 487424 ----a-w- c:\windows\system32\msvcp70.dll
2009-08-20 22:25 . 2009-08-20 22:25 -------- d-----w- c:\program files\AML Products
2009-08-20 22:25 . 2002-01-05 13:48 974848 ----a-w- c:\windows\system32\mfc70.dll
2009-08-19 23:17 . 2009-08-19 23:17 -------- d-----w- c:\documents and settings\Dave\DoctorWeb
2009-08-19 22:27 . 2009-08-19 22:27 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-08-19 20:17 . 2009-08-19 20:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Downloaded Installations
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-17 01:16 . 2005-08-05 13:49 -------- d-----w- c:\program files\SolidWorks
2009-09-17 01:16 . 2005-08-07 14:31 34817 ----a-w- c:\program files\SolidWorksswxJRNL.BAK
2009-09-17 01:09 . 2005-08-05 07:21 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-09-15 18:34 . 2009-09-15 18:34 0 ----a-w- c:\windows\system32\REN12.tmp
2009-09-15 18:34 . 2009-09-15 18:34 0 ----a-w- c:\windows\system32\REN11.tmp
2009-09-09 00:33 . 2007-02-05 01:23 -------- d-----w- c:\documents and settings\Dave\Application Data\U3
2009-09-04 22:01 . 2007-03-05 21:30 -------- d-----w- c:\program files\HP
2009-08-31 23:36 . 2005-08-05 13:57 78040 ----a-w- c:\documents and settings\Dave\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-31 17:41 . 2005-08-07 01:41 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-31 17:41 . 2005-08-07 01:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-25 21:15 . 2005-08-02 10:42 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-05 09:11 . 2004-08-03 21:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-30 21:22 . 2005-08-05 08:59 -------- d-----w- c:\program files\Common Files\Adobe
2009-07-29 04:53 . 2004-08-03 21:00 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-07-29 04:53 . 2004-08-03 21:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-07-17 18:55 . 2004-08-03 21:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 17:08 . 2004-08-03 21:00 286720 ----a-w- c:\windows\system32\wmpdxm.dll
2009-06-25 18:36 . 2004-08-03 21:00 95744 ----a-w- c:\windows\system32\mqsec.dll
2009-06-25 18:36 . 2004-08-03 21:00 661504 ----a-w- c:\windows\system32\mqqm.dll
2009-06-25 18:36 . 2004-08-03 21:00 517120 ----a-w- c:\windows\system32\mqsnap.dll
2009-06-25 18:36 . 2004-08-03 21:00 48640 ----a-w- c:\windows\system32\mqupgrd.dll
2009-06-25 18:36 . 2004-08-03 21:00 471552 ----a-w- c:\windows\system32\mqutil.dll
2009-06-25 18:36 . 2004-08-03 21:00 47104 ----a-w- c:\windows\system32\mqdscli.dll
2009-06-25 18:36 . 2004-08-03 21:00 225280 ----a-w- c:\windows\system32\mqoa.dll
2009-06-25 18:36 . 2004-08-03 21:00 186880 ----a-w- c:\windows\system32\mqtrig.dll
2009-06-25 18:36 . 2004-08-03 21:00 177152 ----a-w- c:\windows\system32\mqrt.dll
2009-06-25 18:36 . 2004-08-03 21:00 16896 ----a-w- c:\windows\system32\mqise.dll
2009-06-25 18:36 . 2004-08-03 21:00 138240 ----a-w- c:\windows\system32\mqad.dll
2009-06-25 18:36 . 2004-08-03 21:00 123392 ----a-w- c:\windows\system32\mqrtdep.dll
2009-06-25 08:44 . 2004-08-03 21:00 724480 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:44 . 2004-08-03 21:00 59392 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:44 . 2004-08-03 21:00 56320 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:44 . 2004-08-03 21:00 298496 ----a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:44 . 2004-08-03 21:00 168448 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:44 . 2004-08-03 21:00 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-22 11:49 . 2004-08-03 21:00 19968 ----a-w- c:\windows\system32\mqbkup.exe
2009-06-22 11:49 . 2004-08-03 21:00 117248 ----a-w- c:\windows\system32\mqtgsvc.exe
2009-06-22 11:49 . 2004-08-03 21:00 4608 ----a-w- c:\windows\system32\mqsvc.exe
2009-06-22 11:48 . 2004-08-03 21:00 91776 ----a-w- c:\windows\system32\drivers\mqac.sys
2009-06-22 11:34 . 2004-08-03 21:00 92544 ----a-w- c:\windows\system32\drivers\ksecdd.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-09-11_22.11.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-15 08:02 . 2009-09-15 08:02 84661 c:\windows\SYSTEM32\Macromed\Flash\uninstall_plugin.exe
+ 2009-07-18 03:21 . 2009-07-18 03:21 257440 c:\windows\SYSTEM32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2009-09-15 18:44 . 2009-09-15 18:44 149280 c:\windows\SYSTEM32\javaws.exe
+ 2009-09-15 18:44 . 2009-09-15 18:44 145184 c:\windows\SYSTEM32\javaw.exe
+ 2009-09-15 18:44 . 2009-09-15 18:44 145184 c:\windows\SYSTEM32\java.exe
+ 2009-01-18 23:05 . 2009-01-18 23:05 675840 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0100000010\9.1.0\JP2KLib.dll
+ 2009-07-18 03:21 . 2009-07-18 03:21 3883424 c:\windows\SYSTEM32\Macromed\Flash\NPSWF32.dll
+ 2009-09-15 07:45 . 2009-09-15 07:45 6653952 c:\windows\Installer\689eb.msp
+ 2009-09-15 18:44 . 2009-09-15 18:44 1757696 c:\windows\Installer\47cc1.msi
+ 2008-12-18 23:48 . 2008-12-18 23:48 3645440 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0100000010\9.1.0\authplay.dll
+ 2009-02-27 23:37 . 2009-02-27 23:37 20403568 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0100000010\9.1.0\AcroRd32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"c:\program files\1&1\1&1 EasyLogin\EasyLogin.exe"="1&1 EasyLogin HIDE" [X]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-02-15 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-02-15 126976]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2005-03-04 606208]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 53248]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-06 110592]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-05 127035]
"DataLayer"="c:\program files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2006-10-27 863744]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-08 222208]
"Adobe Reader Speed Launcher"="d:\program downloads\adobe 9\Reader\Reader_sl.exe" [2009-02-28 35696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-15 149280]
"Logitech Utility"="Logi_MwX.Exe" - c:\windows\LOGI_MWX.EXE [2003-12-17 19968]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-10 1634304]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2005-8-5 49254]
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-1-14 479232]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-8-2 24576]
Picture Package Menu.lnk - d:\program downloads\Picture Package Menu\SonyTray.exe [2007-8-23 151552]
Picture Package VCD Maker.lnk - d:\program downloads\Picture Package Applications\Residence.exe [2007-8-23 106496]
SBC Self Support Tool.lnk - c:\program files\SBC Self Support Tool\bin\matcli.exe [2005-12-24 217088]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-09-07 08:08 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\ypager.exe" -quiet
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"YBrowser"=c:\program files\Yahoo!\browser\ybrwicon.exe
"BJCFD"=c:\program files\BroadJump\Client Foundation\CFD.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\yserver.exe"=
"d:\\Movies\\VLC\\vlc.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\SolidWorks\\SLDWORKS.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe"=
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [8/31/2009 2:02 PM 108289]
R3 GTIPCI21;GTIPCI21;c:\windows\SYSTEM32\DRIVERS\gtipci21.sys [12/31/1979 9:00 AM 80384]
.
Contents of the 'Scheduled Tasks' folder
2007-05-17 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2005-08-07 22:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bing.com/
mStart Page = hxxp://www.dell.com/ap/china/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Dave\Application Data\Mozilla\Firefox\Profiles\i8wujhmy.default\
FF - prefs.js: browser.startup.homepage - hxxps://ssl.scroogle.org/
FF - prefs.js: network.proxy.http - proxy.starhub.net.sg
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\Dave\Application Data\Mozilla\Firefox\Profiles\i8wujhmy.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - plugin: d:\program downloads\adobe 9\Reader\browser\nppdf32.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-17 03:20
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(676)
c:\program files\Intel\Wireless\Bin\LgNotify.dll
c:\windows\system32\igfxsrvc.dll
c:\windows\system32\hccutils.DLL
.
Completion time: 2009-09-17 3:23
ComboFix-quarantined-files.txt 2009-09-17 10:22
ComboFix2.txt 2009-09-15 07:19
ComboFix3.txt 2009-09-11 22:14
Pre-Run: 296,857,600 bytes free
Post-Run: 356,835,328 bytes free
210 --- E O F --- 2009-08-24 07:50
*******************************************
I checked the system performance and run many of the programs check for connectivity and operation. Everything appears to be operating normally.
Which is hugely successful!!!!!
Greatfully thankful