Hi,
There weren't any other ComboFix.txt files in C:\qoobox. Here are the other files.
ComboFix.txt:
ComboFix 10-01-26.02 - JAbena 01/26/2010 20:20:04.5.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.596 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\combo.com.exe
Command switches used :: c:\documents and settings\JAbena\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
file zipped: c:\documents and settings\All Users\Application Data\h8srtkrl32mainweq.dll
file zipped: c:\windows\system32\drivers\pP0F2J.sys
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\h8srtkrl32mainweq.dll
c:\windows\system32\drivers\pP0F2J.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
——-\Legacy_PP0F2J
——-\Service_pP0F2J
((((((((((((((((((((((((( Files Created from 2009-12-27 to 2010-01-27 )))))))))))))))))))))))))))))))
.
2010-01-23 17:33 . 2010-01-23 17:33 ——– d-s—w- c:\documents and settings\Administrator.NETBOOK.000\UserData
2010-01-23 17:13 . 2010-01-23 17:13 ——– d—–w- c:\documents and settings\Administrator.NETBOOK.000\Local Settings\Application Data\Mozilla
2010-01-23 04:51 . 2010-01-23 04:51 ——– d-s—w- c:\documents and settings\Administrator.NETBOOK\UserData
2010-01-22 08:50 . 2010-01-26 03:47 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-01-21 09:01 . 2010-01-21 09:01 ——– d—–w- c:\program files\Windows Live Safety Center
2010-01-21 08:43 . 2010-01-21 08:43 ——– d—–w- C:\63d8b68237bc4a4c59f834f0
2010-01-21 08:43 . 2010-01-21 08:43 ——– d—–w- C:\f055de69d368e3edc3
2010-01-21 08:31 . 2010-01-21 08:31 ——– d—–w- C:\3b699c428c7b07d0b23770ea
2010-01-21 06:11 . 2009-11-09 19:20 207792 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2010-01-21 06:11 . 2009-10-07 00:31 87784 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2010-01-21 06:11 . 2009-09-03 17:45 70408 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2010-01-21 06:11 . 2010-01-21 06:11 ——– d—–w- c:\program files\Spyware Doctor
2010-01-21 06:11 . 2010-01-21 06:11 ——– d—–w- c:\program files\Common Files\PC Tools
2010-01-21 06:11 . 2010-01-21 06:11 ——– d—–w- c:\documents and settings\JAbena\Application Data\PC Tools
2010-01-21 06:11 . 2010-01-21 06:11 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2010-01-21 06:11 . 2010-01-27 04:28 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-21 05:54 . 2010-01-21 06:50 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-01-07 03:05 . 2010-01-07 03:05 ——– d–h–w- c:\windows\PIF
2009-12-28 08:17 . 2009-12-28 08:17 ——– d—–w- c:\documents and settings\JAbena\Application Data\Mael
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-21 07:29 . 2009-08-01 09:31 ——– d—–w- c:\program files\Common Files\Adobe
2010-01-21 05:54 . 2009-08-01 08:50 ——– d—–w- c:\program files\Google
2010-01-21 05:51 . 2009-11-30 09:27 ——– d—–w- c:\documents and settings\JAbena\Application Data\vlc
2010-01-21 05:06 . 2009-08-01 09:01 ——– d—–w- c:\program files\Microsoft Silverlight
2010-01-18 07:33 . 2009-12-01 11:08 20 —h–w- c:\documents and settings\All Users\Application Data\PKP_DLdu.DAT
2009-12-27 10:41 . 2009-08-01 09:11 ——– d—–w- c:\program files\McAfee
2009-12-22 16:38 . 2009-08-01 08:43 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-12-22 16:38 . 2009-08-01 08:48 ——– d—–w- c:\program files\Common Files\InstallShield
2009-12-22 05:21 . 2009-08-01 07:34 667136 ——w- c:\windows\system32\wininet.dll
2009-12-22 05:20 . 2009-08-01 08:52 81920 —-a-w- c:\windows\system32\ieencode.dll
2009-12-21 06:12 . 2009-11-30 23:15 ——– d—–w- c:\documents and settings\LocalService\Application Data\SACore
2009-12-15 05:28 . 2009-12-15 05:28 ——– d—–w- c:\program files\Common Files\SWF Studio
2009-12-14 19:15 . 2009-12-14 19:15 2146304 —-a-w- c:\windows\system32\GPhotos.scr
2009-12-09 11:01 . 2009-08-01 08:54 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-09 09:54 . 2009-12-09 09:54 54436 —ha-w- c:\windows\system32\mlfcache.dat
2009-12-05 10:20 . 2009-11-30 23:34 60664 —-a-w- c:\documents and settings\JAbena\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-04 19:57 . 2009-12-04 19:57 ——– d—–w- c:\program files\MSBuild
2009-12-04 19:57 . 2009-12-04 19:57 ——– d—–w- c:\program files\Reference Assemblies
2009-12-02 18:35 . 2009-08-01 06:54 76487 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-12-02 09:28 . 2009-12-02 09:28 ——– d—–w- c:\documents and settings\JAbena\Application Data\Hewlett-Packard
2009-12-02 09:27 . 2009-12-02 09:21 20724 —-a-w- c:\windows\hpoins01.dat
2009-12-02 09:27 . 2009-12-02 09:22 ——– d—–w- c:\program files\Hewlett-Packard
2009-12-02 09:27 . 2009-12-02 09:27 82380 —-a-w- c:\windows\system32\drivers\AFS2K.SYS
2009-12-02 09:24 . 2009-12-02 09:24 ——– d—–w- c:\program files\Common Files\Hewlett-Packard
2009-12-02 06:39 . 2009-08-01 09:11 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2009-12-02 06:08 . 2009-12-02 06:09 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-12-02 06:08 . 2009-12-02 06:08 ——– d—–w- c:\program files\Java
2009-12-02 06:07 . 2009-12-02 06:07 152576 —-a-w- c:\documents and settings\JAbena\Application Data\Sun\Java\jre1.6.0_16\lzma.dll
2009-12-02 05:47 . 2009-12-01 11:13 20 —h–w- c:\documents and settings\All Users\Application Data\PKP_DLdw.DAT
2009-12-02 05:46 . 2009-12-01 17:53 ——– d—–w- c:\documents and settings\JAbena\Application Data\Nikon
2009-12-01 21:37 . 2009-12-01 21:37 0 —-a-w- c:\windows\nsreg.dat
2009-12-01 18:57 . 2009-12-01 18:57 ——– d—–w- c:\documents and settings\JAbena\Application Data\eSobi
2009-12-01 11:17 . 2009-12-01 11:17 49152 —-a-r- c:\documents and settings\JAbena\Application Data\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe
2009-12-01 11:17 . 2009-12-01 11:10 ——– d—–w- c:\program files\Common Files\Nikon
2009-12-01 11:17 . 2009-12-01 11:17 57344 —-a-r- c:\documents and settings\JAbena\Application Data\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe
2009-12-01 11:14 . 2009-12-01 11:10 ——– d—–w- c:\program files\Nikon
2009-12-01 11:13 . 2009-12-01 11:13 ——– d—–w- c:\documents and settings\All Users\Application Data\Extensions
2009-12-01 11:13 . 2009-12-01 11:08 ——– d—–w- c:\documents and settings\All Users\Application Data\Ultima_T15
2009-12-01 11:13 . 2009-12-01 11:08 ——– d—–w- c:\documents and settings\All Users\Application Data\EnterNHelp
2009-12-01 11:10 . 2009-12-01 11:10 ——– d—–w- c:\program files\Common Files\muvee Technologies
2009-12-01 11:10 . 2009-12-01 11:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Nikon
2009-12-01 11:08 . 2009-12-01 11:08 ——– d—–w- c:\documents and settings\All Users\Application Data\Documentation
2009-12-01 11:08 . 2003-03-19 20:05 106496 —-a-w- c:\windows\system32\ATL71.DLL
2009-12-01 11:08 . 2009-11-30 09:37 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-12-01 10:43 . 2009-12-01 10:37 ——– d—–w- c:\program files\Ahead
2009-12-01 10:42 . 2009-12-01 10:42 ——– d—–w- c:\program files\Common Files\LightScribe
2009-12-01 10:40 . 2009-12-01 10:40 ——– d—–w- c:\program files\Common Files\Nero
2009-12-01 10:37 . 2009-12-01 10:37 ——– d—–w- c:\documents and settings\All Users\Application Data\Ahead
2009-12-01 10:37 . 2009-12-01 10:37 ——– d—–w- c:\program files\Common Files\Ahead
2009-12-01 09:25 . 2009-12-01 09:25 ——– d—–w- c:\documents and settings\JAbena\Application Data\WindSolutions
2009-12-01 09:25 . 2009-12-01 09:24 ——– d—–w- c:\program files\CopyTrans
2009-11-30 20:58 . 2009-11-30 20:58 64 —-a-w- c:\documents and settings\JAbena\Application Data\wklnhst.dat
2009-11-30 20:58 . 2009-11-30 20:58 ——– d—–w- c:\documents and settings\JAbena\Application Data\Template
2009-11-30 11:02 . 2009-11-30 11:02 ——– d—–w- c:\program files\EphPod
2009-11-30 10:38 . 2009-11-30 10:38 ——– d—–w- c:\documents and settings\JAbena\Application Data\CopyTrans
2009-11-30 09:59 . 2009-11-30 09:40 ——– d—–w- c:\documents and settings\JAbena\Application Data\Apple Computer
2009-11-30 09:42 . 2009-11-30 09:35 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple
2009-11-30 09:40 . 2009-11-30 09:39 ——– d—–w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-11-30 09:40 . 2009-11-30 09:39 ——– d—–w- c:\program files\iTunes
2009-11-30 09:39 . 2009-11-30 09:39 ——– d—–w- c:\program files\iPod
2009-11-30 09:39 . 2009-11-30 09:35 ——– d—–w- c:\program files\Common Files\Apple
2009-11-30 09:38 . 2009-11-30 09:38 ——– d—–w- c:\program files\Bonjour
2009-11-30 09:38 . 2009-11-30 09:37 ——– d—–w- c:\program files\QuickTime
2009-11-30 09:37 . 2009-11-30 09:37 ——– d—–w- c:\program files\Apple Software Update
2009-11-30 09:24 . 2009-11-30 09:24 ——– d—–w- c:\program files\VideoLAN
2009-11-30 08:43 . 2009-11-30 08:43 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\SACore
2009-11-21 15:51 . 2009-08-01 07:34 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-13 22:57 . 2009-08-01 07:02 922112 —-a-w- c:\windows\system32\imapi2fs.dll
2009-11-13 22:57 . 2009-08-01 07:02 426496 —-a-w- c:\windows\system32\imapi2.dll
2009-11-13 01:07 . 2009-11-13 01:07 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-05 00:54 . 2009-08-01 09:14 79816 —-a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-11-05 00:54 . 2009-08-01 09:14 40552 —-a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-11-05 00:54 . 2009-08-01 09:14 35272 —-a-w- c:\windows\system32\drivers\mfebopk.sys
2009-11-05 00:54 . 2009-08-01 09:14 214664 —-a-w- c:\windows\system32\drivers\mfehidk.sys
2009-11-05 00:53 . 2009-08-01 09:14 34248 —-a-w- c:\windows\system32\drivers\mferkdk.sys
.
((((((((((((((((((((((((((((( SnapShot@2010-01-26_04.37.55 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-27 04:27 . 2010-01-27 04:27 16384 c:\windows\Temp\Perflib_Perfdata_73c.dat
+ 2009-08-01 07:34 . 2010-01-27 04:17 68386 c:\windows\system32\perfc009.dat
- 2009-08-01 07:34 . 2010-01-26 04:28 68386 c:\windows\system32\perfc009.dat
+ 2009-11-30 23:25 . 2010-01-27 02:42 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-11-30 23:25 . 2010-01-26 04:28 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-11-30 23:25 . 2010-01-27 02:42 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-11-30 23:25 . 2010-01-26 04:28 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-08-01 07:34 . 2010-01-27 04:17 434266 c:\windows\system32\perfh009.dat
- 2009-08-01 07:34 . 2010-01-26 04:28 434266 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-30 39408]
"Malware Defense"="c:\program files\Malware Defense\mdefense.exe" [BU]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"M3000Mnt"="M3000Rmv.dll " [X]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-16 178712]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-12-30 875016]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-28 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-28 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-28 137752]
"RTHDCPL"="RTHDCPL.EXE" [2009-02-24 17529856]
"AzMixerSel"="c:\program files\Realtek\Audio\Drivers\AzMixerSel.exe" [2006-01-25 53248]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-12-01 30192]
"CarboniteSetupLite"="c:\program files\Carbonite\CarbonitePreinstaller.exe" [2008-10-03 294544]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-02-06 1430824]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-13 141600]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"DVDTray"="c:\program files\Ahead\ODD Toolkit\DVDTray.exe" [2004-09-03 65536]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-02 149280]
"Google Updater"="c:\program files\Google\Google Updater\GoogleUpdater.exe" [2010-01-21 160752]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-11-18 1243088]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
c:\documents and settings\JAbena\Start Menu\Programs\Startup\
Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2007-10-18 479232]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files\Acer\Acer VCM\AcerVCM.exe [2009-8-1 565248]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2002-12-2 40960]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [8/1/2009 1:18 AM 93320]
R2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [8/1/2009 1:35 AM 237568]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [7/31/2009 11:35 PM 38912]
R3 M3000Srv;WebCam Driver;c:\windows\system32\drivers\M3000KNT.sys [9/27/2009 6:58 AM 145152]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [8/1/2009 12:48 AM 1684736]
S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [8/1/2009 12:50 AM 30192]
S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTS5121.sys –> c:\windows\system32\Drivers\RTS5121.sys [?]
S3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys –> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
.
Contents of the 'Scheduled Tasks' folder
2010-01-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 20:34]
2010-01-27 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-11-30 05:54]
2009-08-01 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-08-01 20:22]
2009-08-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-08-01 20:22]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_one&r=0xph11094255l03g4wu25w87123117
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\documents and settings\JAbena\Application Data\Mozilla\Firefox\Profiles\zw6k93lj.default\
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1808.5272\npCIDetect14.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -
AddRemove-HxD Hex Editor_is1 - c:\program files\HxD\unins000.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2010-01-26 20:27
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\progra~1\McAfee\VIRUSS~1\mcshield.exe
c:\program files\McAfee\MPF\MPFSrv.exe
c:\program files\McAfee\MSK\MskSrver.exe
c:\windows\system32\wdfmgr.exe
c:\progra~1\mcafee.com\agent\mcagent.exe
c:\windows\system32\wscntfy.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\igfxsrvc.exe
c:\windows\WebCam\M3000\M3000Mnt.exe
c:\windows\system32\igfxext.exe
c:\program files\iPod\bin\iPodService.exe
c:\\?\c:\windows\system32\WBEM\WMIADAP.EXE
.
**************************************************************************
.
Completion time: 2010-01-26 20:31:46 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-27 04:31
Pre-Run: 129,253,810,176 bytes free
Post-Run: 129,213,882,368 bytes free
- - End Of File - - E1CCC914A8FDF409972CF598E3D20B81
___________________________________________________________________
MBAM log:
Malwarebytes' Anti-Malware 1.44
Database version: 3643
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512
1/26/2010 8:48:14 PM
mbam-log-2010-01-26 (20-48-14).txt
Scan type: Quick Scan
Objects scanned: 138929
Time elapsed: 6 minute(s), 39 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\malware defense (Rogue.MalwareDefense) -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
___________________________________________________________
Kaspersky Report:
——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, January 27, 2010
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, January 27, 2010 05:30:42
Records in database: 3375534
——————————————————————————–
Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes
Scan area - My Computer:
C:\
Scan statistics:
Objects scanned: 59934
Threats found: 4
Infected objects found: 14
Suspicious objects found: 0
Scan duration: 02:44:50
File name / Threat / Threats count
C:\Qoobox\Quarantine\C\WINDOWS\system32\H8SRTflxkvabhvc.dll.vir Infected: Packed.Win32.TDSS.aa 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\H8SRTguswipgjpp.dll.vir Infected: Packed.Win32.TDSS.aa 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\H8SRTqykutrmuid.dll.vir Infected: Packed.Win32.TDSS.aa 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\H8SRTvonxrmvrhc.dll.vir Infected: Packed.Win32.TDSS.aa 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\helper32.dll.vir Infected: Trojan-Ransom.Win32.Agent.js 1
C:\System Volume Information\_restore{577E2158-88B0-493A-BDB5-E2EE0FE6AC39}\RP0\A0000003.dll Infected: Packed.Win32.TDSS.aa 1
C:\System Volume Information\_restore{577E2158-88B0-493A-BDB5-E2EE0FE6AC39}\RP0\A0000004.dll Infected: Packed.Win32.TDSS.aa 1
C:\System Volume Information\_restore{577E2158-88B0-493A-BDB5-E2EE0FE6AC39}\RP0\A0000005.dll Infected: Packed.Win32.TDSS.aa 1
C:\System Volume Information\_restore{577E2158-88B0-493A-BDB5-E2EE0FE6AC39}\RP0\A0000006.dll Infected: Packed.Win32.TDSS.aa 1
C:\System Volume Information\_restore{577E2158-88B0-493A-BDB5-E2EE0FE6AC39}\RP1\A0000062.exe Infected: Trojan-Downloader.Win32.FraudLoad.gkm 1
C:\System Volume Information\_restore{577E2158-88B0-493A-BDB5-E2EE0FE6AC39}\RP1\A0000067.exe Infected: Trojan.Win32.FraudPack.akjg 1
C:\System Volume Information\_restore{577E2158-88B0-493A-BDB5-E2EE0FE6AC39}\RP1\A0000132.dll Infected: Trojan-Ransom.Win32.Agent.js 1
C:\System Volume Information\_restore{577E2158-88B0-493A-BDB5-E2EE0FE6AC39}\RP1\A0000135.exe Infected: Trojan-Downloader.Win32.FraudLoad.gkm 1
C:\System Volume Information\_restore{577E2158-88B0-493A-BDB5-E2EE0FE6AC39}\RP1\A0000137.exe Infected: Trojan-Downloader.Win32.FraudLoad.gkm 1
Selected area has been scanned.
![[external image: Posted Image]](http://i266.photobucket.com/albums/ii277/sUBs_/Gmer_initScan.gif){kind=link}