I was finally able to run combo fix. I had to rename it . Here is the log.
ComboFix 09-12-25.02 - Owner 12/29/2009 15:05:43.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2048.1706 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\virus stuff\Testcombfx.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Owner\Favorites\MyRealPics
c:\documents and settings\Owner\Favorites\MyRealPics
C:\LOG.TXT
c:\program files\INSTALL.LOG
c:\recycler\NPROTECT
c:\recycler\S-1-5-21-1409082233-2111687655-1801674531-1003
C:\Thumbs.db
c:\windows\MailSwitch.ocx
c:\windows\patch.exe
c:\windows\system\oeminfo.ini
c:\windows\system32\ctlib.dll
c:\windows\system32\drivers\H8SRTcslfuvhris.sys
c:\windows\system32\H8SRTckoxnyvcrk.dat
c:\windows\system32\H8SRTueikouafma.dll
c:\windows\system32\H8SRTwgsoypkbwb.dll
c:\windows\system32\krl32mainweq.dll
c:\windows\system32\LORUX[^a.dll
c:\windows\system32\ps2.bat
c:\windows\system32\reboot.txt
c:\windows\system32\srcr.dat
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
——-\Service_H8SRTd.sys
——-\Legacy_H8SRTd.sys
((((((((((((((((((((((((( Files Created from 2009-11-28 to 2009-12-29 )))))))))))))))))))))))))))))))
.
2009-12-29 19:52 . 2009-08-07 00:23 215920 —-a-w- c:\windows\system32\muweb.dll
2009-12-29 19:51 . 2009-08-07 00:23 274288 —-a-w- c:\windows\system32\mucltui.dll
2009-12-29 19:40 . 2009-12-29 19:45 ——– d—–w- c:\program files\Microsoft Security Essentials
2009-12-29 19:28 . 2009-12-03 21:14 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-29 19:28 . 2009-12-29 19:28 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-29 19:28 . 2009-12-29 19:38 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-12-29 19:28 . 2009-12-03 21:13 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-29 17:13 . 2009-12-29 17:13 ——– d—–w- C:\5bd805f96940cf08d00ed7a8
2009-12-29 17:12 . 2009-12-29 17:12 ——– d—–w- c:\program files\Registry Easy
2009-12-28 15:08 . 2009-12-28 15:08 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-12-28 15:08 . 2009-12-28 15:08 152576 —-a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-28 15:07 . 2009-12-28 15:07 79488 —-a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-28 00:08 . 2009-12-28 00:13 ——– d—–w- c:\program files\a-squared Free
2009-12-27 23:19 . 2009-12-27 23:21 ——– dc-h–w- c:\windows\ie8
2009-12-27 17:01 . 2009-12-27 17:01 ——– d—–w- c:\program files\McAfee.com
2009-12-25 19:00 . 2009-07-16 17:32 120136 —-a-w- c:\windows\system32\drivers\Mpfp.sys
2009-12-25 18:44 . 2009-12-26 21:40 ——– d—–w- c:\program files\Common Files\McAfee
2009-12-25 18:43 . 2009-12-27 17:01 ——– d—–w- c:\program files\McAfee
2009-12-25 17:27 . 2009-12-25 17:27 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2009-12-25 17:26 . 2009-12-25 17:26 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2009-12-25 16:12 . 2009-11-04 21:53 34248 —-a-w- c:\windows\system32\drivers\mferkdk.sys
2009-12-25 12:47 . 2009-12-25 12:47 ——– d—–w- c:\program files\Trend Micro
2009-12-24 19:41 . 2009-12-24 19:42 ——– d—–w- C:\c39c9919d290891aac3f27d2
2009-12-23 21:34 . 2009-12-23 21:34 ——– d—–w- C:\3061a3e0589d16aa29
2009-12-23 15:39 . 2009-12-23 15:39 ——– d—–w- C:\b01830936218e51b89
2009-12-20 20:59 . 2009-12-20 20:59 ——– d—–w- c:\program files\Common Files\ParetoLogic
2009-12-20 20:59 . 2009-12-20 20:59 ——– d—–w- c:\documents and settings\All Users\Application Data\ParetoLogic
2009-12-20 20:59 . 2009-12-20 20:59 ——– d—–w- c:\program files\Common Files\XoftSpySE
2009-12-20 20:59 . 2009-12-20 20:59 ——– d—–w- c:\documents and settings\All Users\Application Data\XoftSpySE
2009-12-19 17:45 . 2009-12-19 17:45 ——– d—–w- C:\mfe
2009-12-19 02:25 . 2009-12-19 02:25 ——– d—–w- c:\windows\McAfee.com
2009-12-19 02:06 . 2009-12-19 02:06 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Citrix
2009-12-19 02:06 . 2009-12-19 02:06 61224 —-a-w- c:\documents and settings\Owner\GoToAssistDownloadHelper.exe
2009-12-12 13:49 . 2009-12-12 13:49 52536 —ha-w- c:\windows\system32\mlfcache.dat
2009-12-12 13:39 . 2009-12-12 13:39 ——– d—–w- c:\program files\iPod
2009-12-12 13:38 . 2009-12-12 13:40 ——– d—–w- c:\program files\iTunes
2009-12-12 13:31 . 2009-12-12 13:33 ——– d—–w- c:\program files\QuickTime
2009-12-12 13:26 . 2009-12-12 13:26 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-12-12 13:20 . 2009-12-12 13:20 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.21.10\SetupAdmin.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-28 15:08 . 2005-05-16 00:48 ——– d—–w- c:\program files\Java
2009-12-28 00:22 . 2002-01-16 08:34 ——– d—–w- c:\program files\AWS
2009-12-27 23:31 . 2004-02-06 01:52 ——– d—–w- c:\program files\AIM
2009-12-27 23:15 . 2005-03-07 16:04 ——– d—–w- c:\program files\Registrar Lite
2009-12-27 17:36 . 2009-04-09 14:53 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2009-12-19 22:27 . 2009-10-22 19:53 862040 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\threatwork.exe
2009-12-19 22:27 . 2009-10-22 19:53 206944 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\lavamessage.dll
2009-12-19 22:27 . 2009-10-22 19:53 390288 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\lavalicense.dll
2009-12-19 22:27 . 2009-10-22 19:53 537576 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\aawapi.dll
2009-12-19 22:27 . 2009-10-22 19:53 370744 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\UpdateManager.dll
2009-12-19 22:27 . 2009-10-22 19:53 194104 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\Savapibridge.dll
2009-12-19 22:26 . 2009-11-01 20:55 6296864 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\Resources.dll
2009-12-19 22:26 . 2009-10-22 19:53 933120 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\CEAPI.dll
2009-12-19 22:26 . 2009-10-22 19:53 816272 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\Ad-AwareCommand.exe
2009-12-19 22:26 . 2009-10-22 19:53 822904 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\Ad-AwareAdmin.exe
2009-12-19 22:26 . 2009-10-22 19:53 1643272 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\Ad-Aware.exe
2009-12-19 22:26 . 2009-10-22 19:53 788880 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\AAWTray.exe
2009-12-19 22:26 . 2009-10-22 19:53 1181328 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\AAWService.exe
2009-12-12 13:39 . 2008-11-28 17:06 ——– d—–w- c:\program files\Common Files\Apple
2009-12-12 13:24 . 2009-01-05 01:43 ——– d—–w- c:\program files\Safari
2009-11-24 17:03 . 2007-03-01 04:22 ——– d—–w- c:\program files\InterActual
2009-11-19 20:55 . 2009-10-22 19:53 163728 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\ShellExt.dll
2009-11-19 20:55 . 2009-10-22 19:53 327000 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\RPAPI.dll
2009-11-19 20:54 . 2009-10-22 19:53 87496 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\PrivacyClean.dll
2009-11-19 20:54 . 2009-10-22 19:53 641632 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\AutoLaunch.exe
2009-11-04 21:54 . 2009-11-04 21:54 214664 —-a-w- c:\windows\system32\drivers\mfehidk.sys
2009-11-01 20:55 . 2009-11-01 20:55 93360 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2009-11-01 20:55 . 2009-11-01 20:55 93360 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\Drivers\SBREDrv.sys
2009-11-01 20:55 . 2009-11-01 20:55 554280 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\sbap.dll
2009-11-01 20:55 . 2009-11-01 20:55 15880 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\lsdelete.exe
2009-11-01 20:55 . 2009-10-22 22:02 15880 —-a-w- c:\windows\system32\lsdelete.exe
2009-11-01 20:55 . 2009-11-01 20:55 212480 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\VipreBridge.dll
2009-11-01 20:55 . 2009-11-01 20:55 283944 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\Vipre.dll
2009-11-01 20:55 . 2009-11-01 20:55 1223976 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\SBTE.dll
2009-11-01 20:55 . 2009-11-01 20:55 242984 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\SBRE.dll
2009-10-29 07:45 . 2004-01-08 20:23 916480 —-a-w- c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2004-08-04 07:56 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 07:56 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 06:00 265728 ——w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2002-01-16 08:45 270336 —-a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2002-01-16 08:45 149504 —-a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2002-01-16 08:45 79872 —-a-w- c:\windows\system32\raschap.dll
2009-10-03 08:15 . 2009-10-22 16:08 2924848 -c–a-w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}\Ad-AwareInstallation.exe
2002-09-08 15:49 . 2002-09-08 15:49 765952 —-a-w- c:\program files\winmx330.exe
2008-04-14 00:12 . 2004-12-14 09:14 50688 –sha-w- c:\windows\twain_32.dll
2008-04-14 00:11 . 2002-01-16 08:45 1028096 –sh–w- c:\windows\SYSTEM32\mfc42.dll
2008-04-14 00:12 . 2002-01-16 08:45 57344 –sha-w- c:\windows\SYSTEM32\msvcirt.dll
2008-04-14 00:12 . 2002-01-16 08:45 413696 –sha-w- c:\windows\SYSTEM32\msvcp60.dll
2008-04-14 00:12 . 2002-01-16 08:45 343040 –sha-w- c:\windows\SYSTEM32\msvcrt.dll
2008-04-14 00:12 . 2002-01-16 08:45 84992 –sh–w- c:\windows\SYSTEM32\olepro32.dll
2008-04-14 00:12 . 2002-01-16 08:45 11776 –sh–w- c:\windows\SYSTEM32\regsvr32.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2009-09-13 1048392]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^AutoPlay.exe]
path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\AutoPlay.exe
backup=c:\windows\pss\AutoPlay.exeStartup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BlackBerry Desktop Redirector.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\BlackBerry Desktop Redirector.lnk
backup=c:\windows\pss\BlackBerry Desktop Redirector.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp center UI.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\hp center UI.lnk
backup=c:\windows\pss\hp center UI.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acme.PCHButton]
2001-11-07 09:48 155648 —-a-w- c:\progra~1\HPINST~1\plugin\bin\PCHButton.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2009-08-13 19:51 177440 —-a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtariBanner]
2001-05-22 22:17 49152 —-a-w- c:\program files\Infogrames\Atari Anniversary Edition\Volume 2\Banner.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2006-06-01 18:32 94208 —-a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
2006-03-28 20:48 622592 —-a-r- c:\program files\Brother\Brmfcmon\BrMfcWnd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
2006-04-10 19:58 61440 —-a-w- c:\program files\Brother\ControlCenter3\BrCtrCen.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ——w- c:\windows\SYSTEM32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2001-08-08 07:36 90112 ——w- c:\windows\SYSTEM32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
2003-08-20 18:57 221184 —-a-w- c:\program files\HP\hpcoretech\hpcmpmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2004-09-13 20:49 49152 —-a-w- c:\program files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2003-07-25 14:14 188416 —-a-w- c:\windows\SYSTEM32\spool\drivers\w32x86\3\hpztsb09.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]
2003-08-20 21:15 483328 —-a-r- c:\windows\SYSTEM32\hphmon05.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD05]
2003-08-20 21:23 49152 —-a-r- c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
1998-05-08 00:04 52736 ——w- c:\windows\SYSTEM\hpsysdrv.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2001-08-08 08:25 143360 ——w- c:\windows\SYSTEM32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2005-03-17 19:45 40960 —-a-w- c:\program files\ScanSoft\PaperPort\IndexSearch.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-11-12 21:33 141600 —-a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2001-07-07 05:56 61440 ——w- c:\hp\KBD\KBD.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mail.com]
2002-04-10 19:21 131072 —-a-w- c:\program files\mail.com\mcalert.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 21:40 155648 —-a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2003-07-28 18:19 4841472 —-a-w- c:\windows\SYSTEM32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2003-07-28 18:19 323584 —-a-w- c:\windows\SYSTEM32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2005-03-17 19:25 57393 —-a-w- c:\program files\ScanSoft\PaperPort\pptd40nt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS2]
2001-07-04 05:13 81920 ——w- c:\windows\SYSTEM32\ps2.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-11 04:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealPlayer]
2006-05-26 17:16 1003520 —-a-w- c:\program files\Real\RealPlayer\realplay.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
2001-06-16 06:34 212992 ——w- c:\windows\SMINST\Recguard.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
2006-07-31 14:00 1116920 —-a-w- c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2006-08-10 17:10 221184 —-a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\S3TRAY2]
2001-10-05 02:06 69632 ——w- c:\windows\SYSTEM32\S3tray2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2003-10-14 15:22 155648 —-a-r- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-12-28 15:08 149280 —-a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2003-06-09 19:57 151597 —-a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"XoftSpyService"=3 (0x3)
"WMPNetworkSvc"=3 (0x3)
"Symantec Core LC"=3 (0x3)
"stllssvr"=3 (0x3)
"RoxWatch9"=2 (0x2)
"RoxMediaDB9"=3 (0x3)
"RoxLiveShare9"=2 (0x2)
"Roxio Upnp Server 9"=2 (0x2)
"Roxio UPnP Renderer 9"=3 (0x3)
"Pml Driver HPZ12"=3 (0x3)
"LiveUpdate"=3 (0x3)
"Lavasoft Ad-Aware Service"=2 (0x2)
"Bonjour Service"=2 (0x2)
"Automatic LiveUpdate Scheduler"=2 (0x2)
"NBService"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"iPod Service"=3 (0x3)
"IntuitUpdateService"=2 (0x2)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
R0 Lbd;Lbd;c:\windows\SYSTEM32\drivers\Lbd.sys [10/22/2009 2:54 PM 64288]
R2 a2free;a-squared Free Service;c:\program files\a-squared Free\a2service.exe [12/27/2009 7:08 PM 1858144]
R3 SiS7012;Service for AC'97 Sample Driver (WDM);c:\windows\SYSTEM32\drivers\sis7012.sys [11/16/2001 1:14 AM 164864]
S3 PortlUSB;PortlUSB;c:\windows\system32\DRIVERS\SiriusUSB.sys –> c:\windows\system32\DRIVERS\SiriusUSB.sys [?]
S3 trid3d;trid3d;c:\windows\SYSTEM32\drivers\trid3dm.sys [7/31/2001 7:27 PM 130332]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [9/24/2009 6:17 AM 1181328]
S4 XoftSpyService;XoftSpyService;c:\program files\Common Files\XoftSpySE\6\xoftspyservice.exe [10/23/2009 4:58 PM 582424]
— Other Services/Drivers In Memory —
*Deregistered* - IPVNMon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
pnpsvc
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.comcast.net/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/bin/search?p={searchTerms}
mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1;localhost;*.local
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Backward &Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cac&hed Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
IE: Si&milar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
Trusted Zone: espn.com
Trusted Zone: go.com\*.espn
Trusted Zone: microsoft.com
Trusted Zone: turbotax.com
Trusted Zone: yahoo.com
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\3ai5wax9.default\
FF - prefs.js: browser.search.selectedEngine - MyWebSearch
FF - prefs.js: browser.startup.homepage - hxxp://www.comcast.net/
FF - prefs.js: keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZUman000&fl=0&ptb=6rp9bNtCYhMnBoqGanCpWg&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&st=kwd&searchfor=
FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPJPI150_01.dll
FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -
ShellIconOverlayIdentifiers-{673D79EE-7F51-6354-BD70-E97BDF3DC5EA} - (no file)
ShellExecuteHooks-{362A28B8-6711-4901-9084-3C8D89990F38} - (no file)
MSConfigStartUp-acvapi32 - c:\windows\System32\acvapi32.exe
MSConfigStartUp-AIM - c:\program files\AIM\aim.exe
MSConfigStartUp-AntiMalware - c:\program files\AntiMalware\antimalware.exe
MSConfigStartUp-BJCFD - c:\program files\BroadJump\Client Foundation\CFD.exe
MSConfigStartUp-checktime - c:\program files\HPSelect\Frontend\ct.exe
MSConfigStartUp-clspackxq - c:\docume~1\Owner\LOCALS~1\Temp\clspackxq.exe
MSConfigStartUp-CookiePatrol - c:\progra~1\PESTPA~1\CookiePatrol.exe
MSConfigStartUp-CXMon - c:\program files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
MSConfigStartUp-Daagifi - c:\windows\System32\cwrsrf.exe
MSConfigStartUp-DMXLauncher - c:\program files\Roxio\Media Experience\DMXLauncher.exe
MSConfigStartUp-Fdy - c:\windows\System32\kccfthk.exe
MSConfigStartUp-gcasServ - c:\program files\Microsoft AntiSpyware\gcasServ.exe
MSConfigStartUp-Glmgcd - c:\windows\System32\goywmeh.exe
MSConfigStartUp-mcagent_exe - c:\program files\McAfee.com\Agent\mcagent.exe
MSConfigStartUp-Microsoft Works Update Detection - c:\program files\Microsoft Works\WkDetect.exe
MSConfigStartUp-MoneyAgent - c:\program files\Microsoft Money\System\Money Express.exe
MSConfigStartUp-MSFox - c:\docume~1\Owner\LOCALS~1\Temp\xxx1210.exe
MSConfigStartUp-PestPatrol Control Center - c:\progra~1\PESTPA~1\PPControl.exe
MSConfigStartUp-PPMemCheck - c:\progra~1\PESTPA~1\PPMemCheck.exe
MSConfigStartUp-SetDefPrt - d:\brother\BrStDvPt.exe
MSConfigStartUp-Share-to-Web Namespace Daemon - c:\program files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
MSConfigStartUp-Spyware Begone - c:\documents and settings\Owner\My Documents\Virus and Spyware\SpywareBeGone.exe
MSConfigStartUp-Symantec NetDriver Monitor - c:\progra~1\SYMNET~1\SNDMon.exe
MSConfigStartUp-XoftSpySE - h:\xoftspyse6\XoftSpySE.exe
MSConfigStartUp-Yahoo! Pager - c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
MSConfigStartUp-YBrowser - c:\program files\Yahoo!\browser\ybrwicon.exe
MSConfigStartUp-YOP - c:\progra~1\Yahoo!\YOP\yop.exe
MSConfigStartUp-Zero Knowledge Freedom - c:\program files\Zero Knowledge\Freedom\Freedom.exe
ActiveSetup-4eae938d-fe92-44e8-9e8a-960163738a4f - c:\windows\System32\cmsdr.exe
AddRemove-Coding Workshop Ringtone Converter - c:\progra~1\CODING~1\UNWISE.EXE
AddRemove-Nero - Burning Rom!UninstallKey - e:\nero 7\nero\uninstall\UNNERO.exe
AddRemove-SiS7012 - c:\progra~1\SiS7012\Uninst\uninst2k.exe PCI\VEN_1039&DEV_7012
AddRemove-Works2002Setup - c:\program files\Microsoft Works and Money 2002\Setup\Launcher.exe \hp\tmp\src\
AddRemove-Yahoo! Applications - c:\progra~1\Yahoo!\Common\uninstall.exe
AddRemove-{4BB05099-1963-4268-A3BB-9153964750ED} - h:\xoftspyse6\uninstall.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2009-12-29 15:20
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'explorer.exe'(2240)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Roxio\Drag-to-Disc\Shellex.dll
c:\windows\system32\DLAAPI_W.DLL
c:\windows\system32\CDRTC.DLL
c:\program files\Roxio\Drag-to-Disc\ShellRes.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\McAfee\MPF\MPFSrv.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-12-29 15:33:37 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-29 20:33
Pre-Run: 21,989,965,824 bytes free
Post-Run: 22,667,247,616 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows Whistler Personal" /fastdetect
- - End Of File - - 7F5FFFB22B6B0C6CB3869A9D7980C422
