heres the new combo-fix.exe log:
ComboFix 09-10-27.08 - Alan 10/28/2009 19:01.1.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.428 [GMT -5:00]
Running from: c:\documents and settings\Alan\Desktop\Combo-fix.exe
Command switches used :: c:\documents and settings\Alan\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
FILE ::
"c:\documents and settings\Alan\killbat.bat"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Alan\killbat.bat
.
((((((((((((((((((((((((( Files Created from 2009-09-28 to 2009-10-28 )))))))))))))))))))))))))))))))
.
2009-10-28 17:28 . 2009-10-28 17:28 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Threat Expert
2009-10-28 17:19 . 2009-10-08 16:31 767952 ----a-w- c:\windows\BDTSupport.dll
2009-10-28 17:19 . 2009-10-08 16:31 149456 ----a-w- c:\windows\SGDetectionTool.dll
2009-10-28 17:19 . 2009-10-08 16:31 165840 ----a-w- c:\windows\PCTBDRes.dll
2009-10-28 17:19 . 2009-10-08 16:31 1636304 ----a-w- c:\windows\PCTBDCore.dll
2009-10-28 17:19 . 2009-10-02 19:19 1152470 ----a-w- c:\windows\UDB.zip
2009-10-28 17:19 . 2008-11-26 17:08 131 ----a-w- c:\windows\IDB.zip
2009-10-28 17:16 . 2009-09-24 13:55 229304 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-10-28 17:16 . 2009-10-06 21:31 87784 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-10-28 17:16 . 2009-09-23 21:10 207280 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-10-28 17:16 . 2009-09-03 14:45 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-10-28 17:16 . 2009-10-28 23:55 -------- d-----w- c:\program files\Spyware Doctor
2009-10-28 17:16 . 2009-10-28 17:20 -------- d-----w- c:\program files\Common Files\PC Tools
2009-10-28 17:16 . 2009-10-28 17:16 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-10-28 17:16 . 2009-10-28 17:16 -------- d-----w- c:\documents and settings\Alan\Application Data\PC Tools
2009-10-28 17:04 . 2009-10-28 17:04 -------- d-----w- C:\Combo-fix
2009-10-27 22:57 . 2009-10-27 23:01 111197 ----a-w- C:\MGlogs.zip
2009-10-27 22:57 . 2009-10-27 23:02 -------- d-----w- C:\MGtools
2009-10-27 21:41 . 2009-10-27 22:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-27 21:41 . 2009-10-27 21:45 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-10-27 02:52 . 2009-10-27 22:17 16750112 ----a-w- c:\documents and settings\Alan\ATT_SST_Installer.exe
2009-10-27 02:27 . 2009-10-27 02:27 -------- d-----w- c:\documents and settings\Alan\Application Data\AVG8
2009-10-27 01:19 . 2009-10-27 01:19 -------- d-----w- c:\program files\AxBx
2009-10-26 23:14 . 2009-10-26 23:14 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-10-26 23:14 . 2009-10-26 23:14 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-10-26 23:14 . 2009-10-26 23:14 -------- d-----w- c:\documents and settings\Alan\Application Data\SUPERAntiSpyware.com
2009-10-26 23:13 . 2009-10-26 23:13 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-10-26 01:47 . 2009-10-27 02:06 -------- d-----w- c:\program files\Eusing Free Registry Cleaner
2009-10-25 23:17 . 2009-10-25 23:17 -------- d-----w- c:\documents and settings\Alan\Application Data\Malwarebytes
2009-10-25 23:17 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-25 23:16 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-14 21:34 . 2009-10-14 21:34 -------- d-----w- c:\documents and settings\Alan\Application Data\WebCam Recorder
2009-10-14 21:34 . 2009-10-14 21:34 -------- d-----w- c:\program files\Solent
2009-10-14 21:18 . 2009-10-14 21:18 -------- d-----w- c:\program files\LEDSET
2009-10-14 21:08 . 2007-08-13 19:51 446464 ----a-w- c:\windows\system32\wmvdmoe.dll
2009-10-14 21:08 . 2009-10-14 21:08 -------- d-----w- c:\documents and settings\All Users\Application Data\PY_Software
2009-10-14 20:32 . 2008-04-13 17:39 5504 ----a-w- c:\windows\system32\drivers\MSTEE.sys
2009-10-14 20:32 . 2008-04-13 17:39 5504 ----a-w- c:\windows\system32\dllcache\mstee.sys
2009-10-14 20:32 . 2008-04-13 17:46 10880 ----a-w- c:\windows\system32\drivers\NdisIP.sys
2009-10-14 20:32 . 2008-04-13 17:46 10880 ----a-w- c:\windows\system32\dllcache\ndisip.sys
2009-10-14 20:32 . 2008-04-13 17:46 15232 ----a-w- c:\windows\system32\drivers\StreamIP.sys
2009-10-14 20:32 . 2008-04-13 17:46 15232 ----a-w- c:\windows\system32\dllcache\streamip.sys
2009-10-14 20:31 . 2008-04-13 17:46 11136 ----a-w- c:\windows\system32\drivers\SLIP.sys
2009-10-14 20:31 . 2008-04-13 17:46 11136 ----a-w- c:\windows\system32\dllcache\slip.sys
2009-10-14 20:31 . 2008-04-13 17:46 19200 ----a-w- c:\windows\system32\drivers\WSTCODEC.SYS
2009-10-14 20:31 . 2008-04-13 17:46 19200 ----a-w- c:\windows\system32\dllcache\wstcodec.sys
2009-10-14 20:31 . 2008-04-13 17:46 85248 ----a-w- c:\windows\system32\drivers\NABTSFEC.sys
2009-10-14 20:31 . 2008-04-13 17:46 85248 ----a-w- c:\windows\system32\dllcache\nabtsfec.sys
2009-10-14 20:31 . 2008-04-13 17:46 17024 ----a-w- c:\windows\system32\drivers\CCDECODE.sys
2009-10-14 20:31 . 2008-04-13 17:46 17024 ----a-w- c:\windows\system32\dllcache\ccdecode.sys
2009-10-14 20:30 . 2008-04-13 23:12 53760 ----a-w- c:\windows\system32\vfwwdm32.dll
2009-10-14 20:30 . 2008-04-13 23:12 53760 ----a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2009-10-14 00:47 . 2009-10-14 00:47 -------- d-----w- c:\documents and settings\Alan\Application Data\Publish Providers
2009-10-14 00:47 . 2009-10-14 00:47 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Sony
2009-10-14 00:37 . 2009-10-14 00:47 -------- d-----w- c:\documents and settings\Alan\Application Data\Sony
2009-10-14 00:35 . 2009-10-20 16:29 -------- d-----w- c:\program files\Sony
2009-10-14 00:34 . 2009-10-14 00:34 -------- d-----w- c:\program files\Sony Setup
2009-10-12 22:01 . 2009-10-12 22:15 -------- d-----w- c:\program files\PVPXX
2009-10-12 13:12 . 2009-09-23 15:41 26176 ---ha-w- c:\windows\system32\hamachi.sys
2009-10-05 23:20 . 2009-10-05 23:20 -------- d-----w- C:\Sun
2009-10-05 23:04 . 2009-10-05 23:16 -------- d-----w- c:\documents and settings\Alan\.SunDownloadManager
2009-10-04 20:52 . 2009-10-04 20:52 11933 ----a-w- c:\windows\begofyn.com
2009-10-03 18:03 . 2009-10-01 15:29 195440 ------w- c:\windows\system32\MpSigStub.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-10-28 23:08 . 2008-12-07 03:01 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-28 20:06 . 2008-12-10 00:38 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore
2009-10-28 03:15 . 2008-12-06 03:30 -------- d-----w- c:\program files\Unlocker
2009-10-28 03:01 . 2008-12-10 00:21 -------- d-----w- c:\program files\McAfee
2009-10-28 00:01 . 2007-08-02 03:24 -------- d-----w- c:\program files\Windows Live Safety Center
2009-10-27 22:26 . 2006-08-25 23:36 -------- d-----w- c:\program files\Common Files\Motive
2009-10-27 22:17 . 2006-08-25 23:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
2009-10-27 02:54 . 2006-08-11 03:32 -------- d-----w- c:\program files\Common Files\Jasc Software Inc
2009-10-27 02:51 . 2006-08-11 03:32 -------- d-----w- c:\documents and settings\Alan\Application Data\Jasc Software Inc
2009-10-27 02:33 . 2008-12-06 04:58 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-10-27 00:17 . 2007-12-21 19:00 -------- d-----w- c:\program files\Bellsouth
2009-10-26 23:07 . 2006-08-08 07:13 -------- d-----w- c:\program files\WildTangent
2009-10-26 23:06 . 2006-08-08 07:08 -------- d-----w- c:\program files\Dell
2009-10-25 23:17 . 2008-12-06 03:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-24 23:12 . 2008-12-08 22:23 21870 ----a-w- c:\documents and settings\Everybody\Application Data\wklnhst.dat
2009-10-22 21:53 . 2006-08-29 00:43 -------- d-----w- c:\documents and settings\All Users\Application Data\WildTangent
2009-10-22 21:53 . 2006-08-29 00:44 -------- d-----w- c:\program files\Dell Games
2009-10-22 21:24 . 2008-11-02 02:28 -------- d-----w- c:\program files\Sun
2009-10-22 21:20 . 2006-08-08 07:04 -------- d-----w- c:\program files\Java
2009-10-21 00:55 . 2006-08-22 22:51 29390 ----a-w- c:\documents and settings\Alan\Application Data\wklnhst.dat
2009-10-20 16:25 . 2009-08-17 22:55 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2009-10-15 03:32 . 2006-08-08 07:17 -------- d-----w- c:\program files\Microsoft Works
2009-10-09 13:29 . 2006-08-08 07:18 -------- d-----w- c:\program files\Microsoft Money 2006
2009-10-04 13:04 . 2006-08-11 03:30 -------- d-----w- c:\program files\Dl_cats
2009-09-23 21:57 . 2009-03-01 17:36 58600 ----a-w- c:\documents and settings\Connor\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-16 15:22 . 2008-12-10 00:22 79816 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-09-16 15:22 . 2008-12-10 00:22 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-09-16 15:22 . 2008-12-10 00:22 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-09-16 15:22 . 2008-06-27 12:08 214664 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-09-16 15:22 . 2008-12-10 00:20 34248 ----a-w- c:\windows\system32\drivers\mferkdk.sys
2009-09-16 08:20 . 2009-10-28 17:16 7383 ----a-w- c:\windows\system32\drivers\pctcore.cat
2009-09-15 11:20 . 2009-10-28 17:16 7383 ----a-w- c:\windows\system32\drivers\pctplsg.cat
2009-09-15 07:12 . 2009-10-28 17:16 7412 ----a-w- c:\windows\system32\drivers\PCTAppEvent.cat
2009-09-15 06:01 . 2009-10-28 17:16 7387 ----a-w- c:\windows\system32\drivers\pctgntdi.cat
2009-09-11 14:18 . 2008-10-25 00:03 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-09 23:49 . 2009-09-09 21:46 540 ----a-w- c:\windows\system32\drivers\sthdae.log
2009-09-09 22:26 . 2009-09-09 22:26 -------- d-----w- c:\documents and settings\Alan\Application Data\Blitware
2009-09-09 21:44 . 2006-08-08 07:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-04 21:03 . 2004-08-10 17:51 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-04 00:29 . 2009-09-04 00:29 -------- d-----w- c:\documents and settings\Alan\Application Data\Mael
2009-09-02 12:52 . 2009-09-02 12:52 -------- d-----w- c:\documents and settings\Everybody\Application Data\Datel
2009-09-02 01:00 . 2008-12-14 00:17 58600 ----a-w- c:\documents and settings\Everybody\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-02 00:27 . 2006-08-11 01:50 58600 ----a-w- c:\documents and settings\Alan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-02 00:22 . 2009-09-02 00:22 -------- d-----w- c:\program files\MSBuild
2009-09-02 00:22 . 2009-09-02 00:22 -------- d-----w- c:\program files\Reference Assemblies
2009-09-01 23:47 . 2009-09-01 23:47 -------- d-----w- c:\documents and settings\Alan\Application Data\Datel
2009-08-29 07:36 . 2004-08-10 17:51 832512 ------w- c:\windows\system32\wininet.dll
2009-08-29 07:36 . 2004-08-10 17:51 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:36 . 2004-08-10 17:50 17408 ----a-w- c:\windows\system32\corpol.dll
2009-08-27 21:05 . 2009-08-27 21:04 34 ----a-w- c:\documents and settings\Connor\jagex_runescape_preferences.dat
2009-08-26 08:00 . 2004-08-10 17:51 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-20 20:09 . 2009-08-20 20:09 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-19 01:01 . 2008-12-10 21:28 34 ----a-w- c:\documents and settings\Everybody\jagex_runescape_preferences.dat
2009-08-07 01:10 . 2009-05-30 19:18 3350 --sha-w- c:\windows\system32\KGyGaAvL.sys
2009-08-07 01:10 . 2009-05-30 19:18 88 --sh--r- c:\windows\system32\3F285D0D6D.sys
2009-08-05 09:01 . 2004-08-10 17:51 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 15:13 . 2008-10-25 00:03 2145280 ------w- c:\windows\system32\ntoskrnl.exe
2009-08-04 14:20 . 2008-10-25 00:03 2023936 ------w- c:\windows\system32\ntkrnlpa.exe
2004-08-04 10:00 . 2004-08-10 17:51 94784 --sh--w- c:\windows\twain.dll
2008-04-14 00:12 . 2008-10-25 00:03 551936 --sha-w- c:\windows\system32\oleaut32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{472734EA-242A-422B-ADF8-83D1E48CC825}"= "c:\program files\Spyware Doctor\BDT\PCTBrowserDefender.dll" [2009-10-08 395216]
[HKEY_CLASSES_ROOT\clsid\{472734ea-242a-422b-adf8-83d1e48cc825}]
[HKEY_CLASSES_ROOT\BrowserDefender.BDToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{175B7885-28AB-4D18-8773-7A13A99980A4}]
[HKEY_CLASSES_ROOT\BrowserDefender.BDToolbar]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{472734EA-242A-422B-ADF8-83D1E48CC825}"= "c:\program files\Spyware Doctor\BDT\PCTBrowserDefender.dll" [2009-10-08 395216]
[HKEY_CLASSES_ROOT\clsid\{472734ea-242a-422b-adf8-83d1e48cc825}]
[HKEY_CLASSES_ROOT\BrowserDefender.BDToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{175B7885-28AB-4D18-8773-7A13A99980A4}]
[HKEY_CLASSES_ROOT\BrowserDefender.BDToolbar]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe" [2007-07-28 68856]
"DellSupport-"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-10-13 2000112]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"DLCCCATS"="c:\windows\System32\spool\DRIVERS\W32X 86\3\DLCCtime.dll" [2005-09-14 73728]
"lxczbmgr.exe"="c:\program files\Lexmark 1200 Series\lxczbmgr.exe" [2007-02-08 74672]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2007-02-08 295856]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-09-17 645328]
"McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-07-08 1176808]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-06-10 249856]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
"HelpCenter4.1"="c:\program files\Bellsouth\HelpCenter40b\bin\sprtcmd.exe" [2007-04-13 198184]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-11-01 94208]
"dlccmon.exe"="c:\program files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-10-21 430080]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"CXMon"="c:\program files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" [2000-08-14 32768]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-06 344064]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-23 116040]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2006-09-07 15872]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-09-22 1243088]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-03-23 339968]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1 \DW\dwtrig20.exe" [2007-02-26 437160]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-12-06 03:18 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\mcmscsvc]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\MCODS]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^Documents and Settings^Alan^Start Menu^Programs^Startup^Camio Viewer.lnk]
backup=c:\windows\pss\Camio Viewer.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Auto Detect.lnk]
backup=c:\windows\pss\Auto Detect.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"tmproxy"=2 (0x2)
"TmPfw"=2 (0x2)
"Tmntsrv"=2 (0x2)
"PcCtlCom"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Microsoft Office\\Office10\\WINWORD.EXE"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\lxczcoms.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\McAfee\\VirusScan\\mcods.exe"=
"c:\\Program Files\\Windows Defender\\MsMpEng.exe"=
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [10/28/2009 12:16 PM 207280]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [10/12/2009 9:24 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/12/2009 9:24 PM 74480]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [10/28/2009 12:19 PM 112592]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [12/9/2008 7:25 PM 210216]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [10/28/2009 12:16 PM 358600]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [10/12/2009 9:24 PM 7408]
S1 Hdaudioo;Hdaudioo; [x]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
--- Other Services/Drivers In Memory ---
*Deregistered* - mbr
*Deregistered* - PCTSDInjDriver32
.
Contents of the 'Scheduled Tasks' folder
2009-10-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
2009-10-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1258719614-4290492059-3762695196-1011Core.job
- c:\documents and settings\Everybody\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-10 00:37]
2009-10-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1258719614-4290492059-3762695196-1011UA.job
- c:\documents and settings\Everybody\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-10 00:37]
2009-06-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-12-10 17:22]
2009-08-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-12-10 17:22]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://my.att.net/
uInternet Settings,ProxyOverride = *.local
Trusted Zone: musicmatch.com\online
DPF: {EA7F451B-94DD-4009-A8BF-8F977B0B2696} - hxxp://pbells.broadjump.com/wizlet/StandardInstall/static/controls/WebflowActiveXInstaller_4-2-0.cab
.
************************************************** ************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
GMER - Rootkit Detector and Remover
Rootkit scan 2009-10-28 19:12
Windows 5.1.2600 Service Pack 3 NTFS
detected NTDLL code modification:
ZwClose
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtim e.dll,_RunDLLEntry@16????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ??????????????????????????????????????????????????
scanning hidden files ...
scan completed successfully
hidden files: 0
************************************************** ************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(644)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll
.
Completion time: 2009-10-29 19:15
ComboFix-quarantined-files.txt 2009-10-29 00:15
ComboFix2.txt 2009-10-28 22:11
Pre-Run: 54,197,563,392 bytes free
Post-Run: 54,169,804,800 bytes free
- - End Of File - - 738453AC5DC0A7634BCBE47242F4E1AC