Possible Back Door Trojan

As we discussed, under Blue Screen of Death, it was determined that my laptop had a back door trojan on it. To ensure we don't waste each others time, fixing one only to find out that my other computers are infected also, I'd like someone to look at the combofix report for me and tell me if its go to go or not.

ComboFix 10-02-12.01 - Don Kramer 02/16/2010 16:08:46.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.124 [GMT -8:00]
Running from: c:\documents and settings\Don Kramer\desktop\commy.exe
Command switches used :: /stepdel
AV: McAfee VirusScan *On-access scanning disabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\patch.exe
c:\windows\system\oeminfo.ini
c:\windows\system32\Vbshell.tlb

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_AUTO_HOTKEY_POLLER


((((((((((((((((((((((((( Files Created from 2010-01-17 to 2010-02-17 )))))))))))))))))))))))))))))))
.

2010-02-16 23:33 . 2010-02-16 23:33 -------- d-----w- c:\windows\LastGood.Tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-17 00:32 . 2010-01-05 06:37 -------- d-----w- c:\program files\SpywareGuard
2010-02-16 23:15 . 2010-01-01 21:10 -------- d-----w- c:\documents and settings\Don Kramer\Application Data\HpUpdate
2010-01-08 01:21 . 2010-01-08 01:21 862040 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2010-01-08 01:21 . 2010-01-08 01:21 206944 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2010-01-08 01:21 . 2010-01-08 01:21 390288 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2010-01-08 01:21 . 2010-01-08 01:21 537576 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\aawapi.dll
2010-01-08 01:21 . 2010-01-08 01:21 370744 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-01-08 01:21 . 2010-01-08 01:21 194104 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Savapibridge.dll
2010-01-08 01:20 . 2010-01-08 01:20 6296864 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2010-01-08 01:20 . 2010-01-08 01:20 933120 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-01-08 01:20 . 2010-01-08 01:20 816272 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-01-08 01:20 . 2010-01-08 01:20 822904 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-01-08 01:20 . 2010-01-08 01:20 1643272 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-01-08 01:20 . 2010-01-08 01:20 788880 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-01-08 01:20 . 2010-01-08 01:20 1181328 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-01-05 16:54 . 2010-01-05 16:54 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2010-01-05 16:54 . 2010-01-05 16:54 -------- d-----w- c:\program files\McAfee Security Scan
2010-01-05 07:08 . 2010-01-05 07:08 -------- d-----w- c:\program files\FileHippo.com
2010-01-05 06:27 . 2010-01-05 06:12 -------- d-----w- c:\program files\SpywareBlaster
2010-01-05 01:19 . 2010-01-05 01:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-01-05 01:16 . 2010-01-05 01:16 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-01-05 01:15 . 2010-01-05 01:15 -------- d-----w- c:\program files\Lavasoft
2010-01-04 17:02 . 2010-01-03 23:46 -------- d-----w- c:\program files\McAfee
2010-01-04 02:48 . 2010-01-03 23:23 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2010-01-03 23:47 . 2010-01-03 23:46 -------- d-----w- c:\program files\Common Files\McAfee
2010-01-03 23:47 . 2010-01-03 23:46 -------- d-----w- c:\program files\McAfee.com
2010-01-03 23:35 . 2006-08-19 05:24 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-01-03 23:31 . 2006-08-19 05:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-01-03 16:57 . 2010-01-03 16:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2010-01-03 16:31 . 2006-08-14 23:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Visual Networks
2010-01-03 16:30 . 2006-08-14 02:34 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-01-03 13:28 . 2010-01-03 13:28 -------- d-----w- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2010-01-03 13:28 . 2010-01-03 13:28 -------- d-----w- c:\program files\TeaTimer (Spybot - Search & Destroy)
2010-01-03 13:28 . 2010-01-03 13:28 -------- d-----w- c:\program files\SDHelper (Spybot - Search & Destroy)
2010-01-03 13:28 . 2010-01-03 13:28 -------- d-----w- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2010-01-03 07:22 . 2010-01-03 07:22 -------- d-----w- c:\documents and settings\Don Kramer\Application Data\FCTB000059099
2010-01-03 07:22 . 2010-01-03 07:22 61812 ----a-w- c:\documents and settings\Don Kramer\Application Data\FCTB000059099\Toolbar\Uninst.exe
2009-12-02 13:19 . 2010-01-05 01:19 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-12-02 13:19 . 2010-01-05 03:35 15880 ----a-w- c:\windows\system32\lsdelete.exe
2009-11-28 07:36 . 2010-01-03 07:22 371200 ----a-w- c:\documents and settings\Don Kramer\Application Data\FCTB000059099\Toolbar\RSSReader_plugin.dll
2009-11-27 01:41 . 2009-11-27 21:08 52224 ----a-w- c:\documents and settings\Don Kramer\Application Data\Mozilla\Firefox\Profiles\vi4rzu3x.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
2009-11-27 01:41 . 2009-11-27 21:08 114688 ----a-w- c:\documents and settings\Don Kramer\Application Data\Mozilla\Firefox\Profiles\vi4rzu3x.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\npmozax.dll
2009-11-25 16:34 . 2006-08-14 23:20 21912 ----a-w- c:\documents and settings\Don Kramer\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-21 00:54 . 2006-08-14 04:43 23296 ----a-w- c:\windows\system32\emptyregdb.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{587358e3-e95b-4446-af29-13d6ce820e9c}"= "c:\program files\Pirates - FB\Helper.dll" [2010-01-03 242688]

[HKEY_CLASSES_ROOT\clsid\{587358e3-e95b-4446-af29-13d6ce820e9c}]
[HKEY_CLASSES_ROOT\FreeCauseURLSearchHook.FCToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{1B054924-40F7-436E-B9BA-9ABB4E9C2B6F}]
[HKEY_CLASSES_ROOT\FreeCauseURLSearchHook.FCToolbarURLSearchHook]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{064F9A9F-3A73-41A1-8F33-D0660836FA8B}]
2010-01-03 07:22 1445888 ----a-w- c:\program files\Pirates - FB\Toolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{FCD92A5D-0984-4850-BE14-BDFA192150FF}"= "c:\program files\Pirates - FB\Toolbar.dll" [2010-01-03 1445888]

[HKEY_CLASSES_ROOT\clsid\{fcd92a5d-0984-4850-be14-bdfa192150ff}]
[HKEY_CLASSES_ROOT\FCTB000059099.IEToolbar.3]
[HKEY_CLASSES_ROOT\TypeLib\{D89B2F88-7DAD-4B7B-98A5-DEB146EF3FC6}]
[HKEY_CLASSES_ROOT\FCTB000059099.IEToolbar]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{FCD92A5D-0984-4850-BE14-BDFA192150FF}"= "c:\program files\Pirates - FB\Toolbar.dll" [2010-01-03 1445888]

[HKEY_CLASSES_ROOT\clsid\{fcd92a5d-0984-4850-be14-bdfa192150ff}]
[HKEY_CLASSES_ROOT\FCTB000059099.IEToolbar.3]
[HKEY_CLASSES_ROOT\TypeLib\{D89B2F88-7DAD-4B7B-98A5-DEB146EF3FC6}]
[HKEY_CLASSES_ROOT\FCTB000059099.IEToolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"EasyLinkAdvisor"="c:\program files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-16 454784]
"FileHippo.com"="c:\program files\FileHippo.com\UpdateChecker.exe" [2009-11-02 155648]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="NvQTwk" [X]
"CapFax"="c:\program files\PhoneTools\CapFax.EXE" [2001-11-07 20480]
"GWMDMMSG"="GWMDMMSG.exe" [2001-12-04 101615]
"Hot Key Kbd 9910 Daemon"="SK9910DM.EXE" [2001-01-03 66048]
"AdaptecDirectCD"="c:\program files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2006-08-14 675840]
"MMTray"="c:\program files\MusicMatch\MusicMatch Jukebox\mm_tray.exe" [2005-05-09 135168]
"Speed racer"="c:\program files\Creative\PlayCenter\CTSRReg.exe" [1999-11-16 5632]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 241664]
"mmtask"="c:\program files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2005-05-09 53248]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-04-25 282624]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]
"McAfee Backup"="c:\program files\McAfee\MBK\McAfeeDataBackup.exe" [2009-07-09 5134864]

c:\documents and settings\Don Kramer\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Billminder.lnk - c:\quickenw\BILLMIND.EXE [2006-8-14 30208]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-28 241664]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-5-28 53248]
Install Pending Files.LNK - c:\program files\SIFXINST\SIFXINST.EXE [2006-8-13 569344]
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-27 199184]
Quicken Startup.lnk - c:\quickenw\QWDLLS.EXE [2006-8-14 27136]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sprestrt\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [1/4/2010 5:19 PM 64288]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [12/2/2009 5:19 AM 1181328]
S3 iscFlash;iscFlash;\??\c:\windows\SYSTEM32\DRIVERS\iscflash.sys --> c:\windows\SYSTEM32\DRIVERS\iscflash.sys [?]
S3 PCDRDRV;Pcdr CPU Helper Driver;c:\windows\system32\drivers\PCDRDRV.sys --> c:\windows\system32\drivers\PCDRDRV.sys [?]

--- Other Services/Drivers In Memory ---

*Deregistered* - IPVNMon
.
Contents of the 'Scheduled Tasks' folder

2010-02-17 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 01:20]

2010-02-17 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 01:20]

2010-02-17 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 01:20]

2010-02-17 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 01:20]

2010-02-17 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 01:20]

2010-01-03 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2010-01-03 20:22]

2010-01-03 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2010-01-03 20:22]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://comcast.net/
mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=20008&gct=&gc=1&q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Don Kramer\Application Data\Mozilla\Firefox\Profiles\vi4rzu3x.default\
FF - prefs.js: browser.search.selectedEngine - Search the Web
FF - prefs.js: keyword.URL - hxxp://search.freecause.com/search?fr=freecause&ourmark=3&type=59099&p=
FF - component: c:\documents and settings\Don Kramer\Application Data\Mozilla\Firefox\Profiles\vi4rzu3x.default\extensions\{19627815-20a6-46e6-be34-a0b6967c022a}\components\Engine.dll
FF - component: c:\documents and settings\Don Kramer\Application Data\Mozilla\Firefox\Profiles\vi4rzu3x.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{C94E154B-1459-4A47-966B-4B843BEFC7DB} - c:\program files\AskSearch\bin\DefaultSearch.dll
HKCU-Run-Yahoo! Pager - c:\program files\Yahoo!\Messenger\YahooMessenger.exe
AddRemove-SBC Yahoo! Base Components - c:\progra~1\Yahoo!\Common\unybase.exe
AddRemove-Yahoo! Applications - c:\progra~1\Yahoo!\Common\uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-16 16:33
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2728)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\CTsvcCDA.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\progra~1\McAfee\VIRUSS~1\mcshield.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\McAfee\MPF\MPFSrv.exe
c:\windows\System32\nvsvc32.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\devldr32.exe
c:\progra~1\mcafee.com\agent\mcagent.exe
c:\windows\GWMDMMSG.exe
c:\windows\system32\SK9910DM.EXE
c:\program files\SpywareGuard\sgbhp.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
c:\windows\system32\wscntfy.exe
c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Completion time: 2010-02-16 16:44:39 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-17 00:44

Pre-Run: 66,278,719,488 bytes free
Post-Run: 66,310,574,080 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - F27C3F3AEA5BBA66ED58D0F5557CF961.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /uninstall

This will also reset your restore points.

How is the machine running now?

Hi Belahzur,

I would remove combo fix if I could, however I can not find it. Per the instructions I recevied by one of the other techs, the file was saved to my desktop under the name commy.exe and it no longer appears there after the program was ran. As for the Combo fix report that's attached, does it show any signs of a BD trojan or anything else that I need to worry about?

Nope, it looks good to me.