Ok, here's the log:
ComboFix 10-09-22.06 - PATRICIA 09/23/2010 11:18:20.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.630.117 [GMT -4:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\PATRICIA\Local Settings\Temporary Internet Files\TestBrowser.html
c:\program files\Total PC Defender
c:\windows\system32\_004574_.tmp.dll
c:\windows\system32\_004575_.tmp.dll
c:\windows\system32\_004576_.tmp.dll
c:\windows\system32\_004577_.tmp.dll
c:\windows\system32\_004584_.tmp.dll
c:\windows\system32\_004585_.tmp.dll
c:\windows\system32\_004586_.tmp.dll
c:\windows\system32\_004587_.tmp.dll
c:\windows\system32\_004589_.tmp.dll
c:\windows\system32\_004590_.tmp.dll
c:\windows\system32\_004593_.tmp.dll
c:\windows\system32\_004594_.tmp.dll
c:\windows\system32\_004596_.tmp.dll
c:\windows\system32\_004597_.tmp.dll
c:\windows\system32\_004598_.tmp.dll
c:\windows\system32\_004600_.tmp.dll
c:\windows\system32\_004603_.tmp.dll
c:\windows\system32\_004604_.tmp.dll
c:\windows\system32\_004608_.tmp.dll
c:\windows\system32\_004609_.tmp.dll
c:\windows\system32\_004611_.tmp.dll
c:\windows\system32\_004614_.tmp.dll
c:\windows\system32\_004616_.tmp.dll
c:\windows\system32\_004617_.tmp.dll
c:\windows\system32\_004618_.tmp.dll
c:\windows\system32\_004619_.tmp.dll
c:\windows\system32\_004620_.tmp.dll
c:\windows\system32\_004623_.tmp.dll
c:\windows\system32\_004624_.tmp.dll
c:\windows\system32\_004625_.tmp.dll
c:\windows\system32\_004626_.tmp.dll
c:\windows\system32\_004627_.tmp.dll
c:\windows\system32\accdccbceecafcc.dll
.
((((((((((((((((((((((((( Files Created from 2010-08-23 to 2010-09-23 )))))))))))))))))))))))))))))))
.
2010-09-22 05:28 . 2010-09-22 05:28 ——– d—–w- C:\Downloads
2010-09-22 05:28 . 2010-09-22 06:00 ——– d—–w- c:\documents and settings\PATRICIA\Application Data\Internet Download Accelerator
2010-09-22 05:28 . 2007-10-15 16:06 1412608 —-a-w- c:\documents and settings\PATRICIA\Application Data\Internet Download Accelerator\temp\skin.dll
2010-09-22 04:31 . 2010-09-22 04:47 ——– d—–w- c:\program files\FeyAccelerator
2010-09-22 02:32 . 2010-09-22 02:32 ——– d—–w- c:\documents and settings\PATRICIA\Application Data\Avira
2010-09-22 02:23 . 2010-09-22 03:19 ——– d—–w- c:\windows\system32\NtmsData
2010-09-22 02:08 . 2010-03-01 14:05 124784 —-a-w- c:\windows\system32\drivers\avipbb.sys
2010-09-22 02:08 . 2010-02-16 18:24 60936 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2010-09-22 02:08 . 2009-05-11 16:49 45416 —-a-w- c:\windows\system32\drivers\avgntdd.sys
2010-09-22 02:08 . 2009-05-11 16:49 22360 —-a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-09-22 02:08 . 2010-09-22 02:08 ——– d—–w- c:\program files\Avira
2010-09-22 02:08 . 2010-09-22 02:08 ——– d—–w- c:\documents and settings\All Users\Application Data\Avira
2010-09-21 15:32 . 2010-09-21 21:27 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-09-21 15:32 . 2010-09-21 20:39 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-09-20 16:27 . 2010-09-20 16:27 12552 —-a-w- c:\windows\system32\drivers\hddirect.sys
2010-09-20 15:42 . 2010-09-22 03:37 ——– d—–w- c:\program files\WormBlaster Software ™
2010-09-20 15:28 . 2010-09-20 15:29 ——– d—–w- c:\program files\Zone Labs
2010-09-20 15:27 . 2010-09-20 15:29 ——– d—–w- c:\windows\Internet Logs
2010-09-20 12:44 . 2010-09-20 12:44 ——– d—–w- c:\documents and settings\PATRICIA\IECompatCache
2010-09-20 12:37 . 2010-09-20 12:37 ——– d—–w- c:\program files\Platinum Guard
2010-09-20 12:23 . 2010-09-20 16:16 ——– d—–w- c:\program files\Internet Cell Boost
2010-09-17 12:42 . 2010-09-17 12:42 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-23 15:35 . 2009-11-13 06:19 ——– d—–w- c:\program files\WeFi
2010-09-23 14:12 . 2009-10-01 05:57 ——– d—–w- c:\documents and settings\PATRICIA\Application Data\Azureus
2010-09-23 14:08 . 2009-10-01 05:24 ——– d—–w- c:\documents and settings\PATRICIA\Application Data\vlc
2010-09-20 16:16 . 2009-12-17 07:10 ——– d—–w- c:\program files\WinAce
2010-09-20 15:31 . 2009-02-27 14:18 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2010-09-20 14:45 . 2010-01-04 06:14 ——– d—–w- c:\program files\Spyware Doctor
2010-08-22 23:05 . 2009-12-17 08:54 ——– d—–w- c:\documents and settings\PATRICIA\Application Data\dvdcss
2010-08-19 11:19 . 2010-08-18 22:07 ——– d—–w- c:\program files\FDN
2010-08-17 13:17 . 2004-08-04 01:07 58880 —-a-w- c:\windows\system32\spoolsv.exe
2010-08-13 01:09 . 2010-08-13 01:08 ——– d—–w- c:\program files\SpeedLord
2010-08-13 00:57 . 2010-08-13 00:57 ——– d—–w- c:\program files\Internet Cyclone
2010-08-12 23:10 . 2010-08-12 23:10 ——– d—–w- c:\program files\'Full Speed' Internet Booster + Performance Tests
2010-08-12 06:26 . 2010-08-12 06:26 310208 —-a-w- c:\documents and settings\PATRICIA\Application Data\Azureus\plugins\mlab\ShaperProbeC.exe
2010-08-12 06:25 . 2009-10-01 05:53 ——– d—–w- c:\program files\Vuze
2010-08-11 02:06 . 2009-02-27 14:18 ——– d—–w- c:\documents and settings\All Users\Application Data\TEMP
2010-08-11 00:47 . 2010-08-11 00:40 ——– d—–w- c:\documents and settings\All Users\Application Data\SpeedBit
2010-08-10 00:08 . 2007-04-01 01:19 276 ——w- c:\windows\system32\tcp2.reg
2010-08-08 01:01 . 2010-08-08 01:01 ——– d—–w- c:\documents and settings\PATRICIA\Application Data\Amazon
2010-07-27 06:30 . 2010-07-27 06:30 8462336 —-a-w- c:\windows\system32\SET27E.tmp
2010-07-22 15:49 . 2004-08-04 01:07 590848 —-a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 05:57 . 2009-04-16 09:36 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2010-07-22 00:49 . 2010-05-01 01:54 272 ——w- c:\windows\system32\bsf.reg
2010-07-19 16:04 . 2010-07-19 16:04 148432 —-a-w- c:\windows\system32\22c2be1517e3b3bfbde8c567a59734f5.exe
2010-07-19 16:04 . 2010-07-19 16:04 148496 —-a-w- c:\windows\system32\c6e6abadf1c96d4efb7fed41b3efc646.exe
2010-07-18 13:31 . 2010-07-18 13:31 148432 —-a-w- c:\windows\system32\25a5a36780ace030332aa4aaca2a4b49.exe
2010-07-18 13:31 . 2010-07-18 13:31 148496 —-a-w- c:\windows\system32\a059c1f23fb6ee4e33ceac91f5ff2c55.exe
2010-07-17 22:32 . 2010-07-17 22:32 148432 —-a-w- c:\windows\system32\ddf10256a13e1efa8525a7054e52a2c4.exe
2010-07-17 22:32 . 2010-07-17 22:32 148496 —-a-w- c:\windows\system32\eedd40afefe61a77561ceeb61e8aa50d.exe
2010-07-15 02:02 . 2010-07-15 02:02 148432 —-a-w- c:\windows\system32\61b0a809f6e34e0bb7cf64c6fbc40f7b.exe
2010-07-15 02:02 . 2010-07-15 02:02 148496 —-a-w- c:\windows\system32\21afdad3c1f709746d1896eb33dd0c23.exe
2010-07-12 12:40 . 2010-07-12 12:40 148432 —-a-w- c:\windows\system32\ba9ec4bb97f5221c749dbeecb3fa964a.exe
2010-07-12 12:40 . 2010-07-12 12:40 148496 —-a-w- c:\windows\system32\4ee14ad7afa0f278d55a49db6dbcd06a.exe
2010-07-08 02:15 . 2010-07-08 02:15 148432 —-a-w- c:\windows\system32\17f934dba4f2253e16fa2f310c129e66.exe
2010-07-08 02:15 . 2010-07-08 02:15 148496 —-a-w- c:\windows\system32\d402208e88c094703537b9b419a97d1d.exe
2010-07-06 01:49 . 2010-07-06 01:49 148432 —-a-w- c:\windows\system32\af6eb1004b2081b4eb48506b3a02a71a.exe
2010-07-06 01:49 . 2010-07-06 01:49 148496 —-a-w- c:\windows\system32\f66fb9dcc1e85183585fe829e757ac32.exe
2010-07-05 10:28 . 2010-07-05 10:28 148432 —-a-w- c:\windows\system32\c8dcc9c34b22b701dd230b6689119c61.exe
2010-07-05 10:27 . 2010-07-05 10:27 148496 —-a-w- c:\windows\system32\6635f84394f00385645166fb26ecbf7e.exe
2010-07-04 16:32 . 2010-07-04 16:32 148432 —-a-w- c:\windows\system32\892c375664c530a5220e616e84984331.exe
2010-07-04 16:32 . 2010-07-04 16:32 148496 —-a-w- c:\windows\system32\c35e0e2a06ce5fc7f15b0f87fed62716.exe
2010-07-03 16:03 . 2010-07-03 16:03 148432 —-a-w- c:\windows\system32\93174bb4e6104fdf7c4527e4303036b1.exe
2010-07-03 16:03 . 2010-07-03 16:03 148496 —-a-w- c:\windows\system32\47d7b8a35267f1130231971618fee404.exe
2010-06-30 22:41 . 2010-06-30 22:41 148432 —-a-w- c:\windows\system32\41b19533e694c5193083cae672a23024.exe
2010-06-30 22:41 . 2010-06-30 22:41 148496 —-a-w- c:\windows\system32\8a8768883cb3ce6a1c427dce17c4feec.exe
2010-06-30 12:31 . 2009-03-06 13:05 149504 —-a-w- c:\windows\system32\schannel.dll
2010-06-30 00:03 . 2010-06-30 00:03 148432 —-a-w- c:\windows\system32\09b1350ccbce73af55f4ac93203267c8.exe
2010-06-30 00:03 . 2010-06-30 00:03 148496 —-a-w- c:\windows\system32\111e52faf33104cd941f54066b6b4ce5.exe
2010-06-29 04:34 . 2010-06-29 04:34 161744 —-a-w- c:\windows\system32\073e7c2163d58bfa07c440692448b66a.exe
2010-06-29 04:34 . 2010-06-29 04:34 161808 —-a-w- c:\windows\system32\a9404ec293f9f701191840079aaa2a54.exe
2010-06-26 06:39 . 2010-06-26 06:39 161744 —-a-w- c:\windows\system32\2e2eb1187738b6f20701b6454577fe64.exe
2010-06-26 06:39 . 2010-06-26 06:39 161808 —-a-w- c:\windows\system32\6af898d99eb4a0c7940442ff4a399bfa.exe
2009-12-16 05:25 . 2009-12-10 06:15 119312 -c–a-w- c:\program files\mozilla firefox\components\debbfcbaa.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-07 68856]
"wefi"="c:\program files\WeFi\\WeFi.exe" [2010-07-25 1645912]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 122880]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
c:\documents and settings\PATRICIA\Start Menu\Programs\Startup\
Zapu Acceleration Engine.lnk - c:\program files\Zapu\Zapu Accelerator\wincm.exe [2010-8-12 155648]
Zapu Accelerator.lnk - c:\program files\Zapu\Zapu Accelerator\wDivi.exe [2010-8-12 147456]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HDDirect.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Zapu\\Zapu Accelerator\\wDivi.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [1/4/2010 2:14 AM 207792]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [9/21/2010 10:08 PM 135336]
R3 WefiEngSvc;WeFi Engine Service;c:\program files\WeFi\WefiEngSvc.exe [7/25/2010 11:14 AM 120152]
S0 a542c00b0ef815089707379334af5b6e;a542c00b0ef815089707379334af5b6e;c:\windows\system32\a542c00b0ef815089707379334af5b6e.sys –> c:\windows\system32\a542c00b0ef815089707379334af5b6e.sys [?]
S2 ccceaacbfbfe;00aa55048633681d71f1f2dc93974f4b;c:\windows\ccceaacbfbfe.exe /s –> c:\windows\ccceaacbfbfe.exe [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [4/24/2010 9:28 AM 135664]
S3 HDDirect;Hard Disk Direct Control;c:\windows\system32\drivers\hddirect.sys [9/20/2010 12:27 PM 12552]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [1/4/2010 2:14 AM 359624]
— Other Services/Drivers In Memory —
*Deregistered* - ndiszapu
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder
2010-09-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-24 13:28]
2010-09-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-24 13:28]
2010-09-23 c:\windows\Tasks\User_Feed_Synchronization-{D131CE83-A104-4C0B-9254-802AEDCF91E4}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 08:31]
2010-09-23 c:\windows\Tasks\WefiStartup.job
- c:\program files\WeFi\WefiStartup.exe [2010-07-25 15:14]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Download ALL with IDA
IE: Download remotely with IDA
IE: Download with IDA
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\PATRICIA\Application Data\Mozilla\Firefox\Profiles\sj4a0y5k.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2504091&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google Powered Search
FF - prefs.js: network.proxy.type - 4
—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
HKCU-Run-Multi File Downloader - c:\program files\Multi File Downloader\MultiFileDownloader.exe
HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe
HKLM-Run-tcp2 - tcp2.exe
Notify-afaabbafaef - c:\windows\system32\afaabbafaef.dll
SafeBoot-HDDirect
AddRemove-Adobe Flash Player Plugin - c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
AddRemove-Internet Cell Boost3.0.0 - c:\program files\Internet Cell Boost\Uninstall.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2010-09-23 11:34
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
[HKEY_USERS\S-1-5-21-583907252-789336058-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{D118EAF7-BAC8-5170-8BB3-F01CEF5B156F}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'explorer.exe'(1864)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\BCMSMMSG.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\WeFi\WeFi.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-09-23 11:41:31 - machine was rebooted
ComboFix-quarantined-files.txt 2010-09-23 15:41
Pre-Run: 5,894,209,536 bytes free
Post-Run: 6,582,452,224 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - B6D15818E34CDD73569BBE6366DEBCE4
![[external image: Posted Image]](http://i582.photobucket.com/albums/ss269/Cat_Byte/GMER/gmer_screen2-1.gif){kind=link}