Trojan/Virus Redirect Problems

Hello TomK,

The D Drive would be a "Junk Collecting" drive, and a "backup" drive.


Some of the stuff on there is from 6 old computers ago.

I never find the time to sort through those files to keep what I want, so
that I can delete the rest.

Instead, everytime I get a new computer, I just transfer all of the old stuff to
the new computer, and I forget all about it - which is the reason for the junks.




Here is the ComboFix log:


ComboFix 11-07-15.03 - Ike 07/15/2011 19:09:12.7.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1530 [GMT -10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Ike\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Firewall *Disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
FILE ::
"c:\documents and settings\Ike\Desktop\System Tools\VundoFix\process.exe"
"d:\data files\Software Downloads\Utilities\Converters\WMA Converter\Setup_FreeConverter.exe"
"d:\data files\Software Downloads\Utilities\Firewall\ZoneAlarm\2008-07-09-Fix\zlsSetup_70_483_000_en.exe"
"d:\data files\Software Downloads\Utilities\Firewall\ZoneAlarm\Build_70_462_000\zlsSetup_70_462_000_en.exe"
"d:\old computer files\_Drive-E\OldOldDrive\OldD\Internet\Eudora4.3.1\Downloads\heat.exe"
"d:\old computer files\_Drive-E\OldOldDrive\OldF\Zipped\Internet\Winsocks\Trumpet32\twsk30d.zip"
"d:\old computer files\_Drive-E\Software Downloads\MediaEditing\FlashMXServer1.5\Flash5Cra.zip"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Ike\Desktop\System Tools\VundoFix\process.exe
d:\data files\Software Downloads\Internet\FileRetrievers\FrostWire
d:\data files\Software Downloads\Internet\FileRetrievers\FrostWire\frostwire-4.13.4.windows.exe
d:\data files\Software Downloads\Utilities\Converters\WMA Converter\Setup_FreeConverter.exe
d:\data files\Software Downloads\Utilities\Firewall\ZoneAlarm\2008-07-09-Fix\zlsSetup_70_483_000_en.exe
d:\data files\Software Downloads\Utilities\Firewall\ZoneAlarm\Build_70_462_000\zlsSetup_70_462_000_en.exe
d:\old computer files\_Drive-E\OldOldDrive\OldD\Internet\Eudora4.3.1\Downloads\heat.exe
d:\old computer files\_Drive-E\OldOldDrive\OldF\Zipped\Internet\Winsocks\Trumpet32\twsk30d.zip
d:\old computer files\_Drive-E\Software Downloads\MediaEditing\FlashMXServer1.5\Flash5Cra.zip
.
.
((((((((((((((((((((((((( Files Created from 2011-06-16 to 2011-07-16 )))))))))))))))))))))))))))))))
.
.
2011-07-15 22:33 . 2011-06-07 15:55 7074640 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{83734249-B3B3-453B-8FDC-5A8C8B290D22}\mpengine.dll
2011-07-15 06:14 . 2003-06-26 02:05 266360 —-a-w- c:\windows\system32\TweakUI.exe
2011-07-13 21:03 . 2011-07-13 21:03 ——– d—–w- C:\_OTL
2011-07-11 04:40 . 2011-07-11 04:40 ——– d—–w- c:\documents and settings\Ike\Local Settings\Application Data\PCHealth
2011-07-01 06:06 . 2011-07-04 11:36 441176 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-06-22 10:12 . 2011-03-18 11:24 69120 —-a-w- c:\windows\system32\zlcomm.dll
2011-06-22 10:12 . 2011-03-18 11:24 104448 —-a-w- c:\windows\system32\zlcommdb.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-04 11:43 . 2010-07-30 00:09 40112 —-a-w- c:\windows\avastSS.scr
2011-07-04 11:43 . 2005-12-29 03:14 199304 —-a-w- c:\windows\system32\aswBoot.exe
2011-07-04 11:36 . 2008-04-05 14:12 309848 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-04 11:35 . 2005-12-29 04:10 43608 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-04 11:35 . 2005-12-29 04:10 102616 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2011-07-04 11:35 . 2005-12-29 04:10 96344 —-a-w- c:\windows\system32\drivers\aswmon.sys
2011-07-04 11:32 . 2005-12-29 03:14 25432 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-04 11:32 . 2005-12-29 04:10 30808 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2011-07-04 11:32 . 2008-04-05 14:12 19544 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-06-26 08:49 . 2011-05-13 02:10 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-07 15:55 . 2009-01-11 14:50 7074640 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-06-02 14:02 . 2003-03-31 12:00 1858944 —-a-w- c:\windows\system32\win32k.sys
2011-05-25 05:14 . 2009-10-02 23:13 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-05-04 14:52 . 2010-04-16 04:43 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-05-04 12:25 . 2008-01-16 16:24 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-05-02 15:31 . 2005-12-28 21:39 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25 . 2003-03-31 12:00 151552 —-a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19 . 2003-03-31 12:00 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-26 11:07 . 2003-03-31 12:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2011-04-26 11:07 . 2003-03-31 12:00 293376 —-a-w- c:\windows\system32\winsrv.dll
2011-04-25 15:51 . 2005-10-21 22:51 832512 —-a-w- c:\windows\system32\wininet.dll
2011-04-25 15:51 . 2004-08-04 07:56 78336 —-a-w- c:\windows\system32\ieencode.dll
2011-04-25 15:51 . 2003-03-31 12:00 1830912 —-a-w- c:\windows\system32\inetcpl.cpl
2011-04-25 15:51 . 2003-03-31 12:00 17408 —-a-w- c:\windows\system32\corpol.dll
2011-04-25 12:01 . 2004-08-04 05:59 389120 —-a-w- c:\windows\system32\html.iec
2011-04-21 13:37 . 2003-03-31 12:00 105472 —-a-w- c:\windows\system32\drivers\mup.sys
2006-05-03 09:06 163328 –sh–r- c:\windows\system32\flvDX.dll
2007-02-21 10:47 31232 –sh–r- c:\windows\system32\msfDX.dll
2008-03-16 12:30 216064 –sh–r- c:\windows\system32\nbDX.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-07-14_05.59.17 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-07-16 05:24 . 2011-07-16 05:24 16384 c:\windows\TEMP\Perflib_Perfdata_738.dat
+ 2011-07-15 13:18 . 2011-07-15 13:18 339968 c:\windows\erdnt\AutoBackup\7-15-2011\Users\00000002\UsrClass.dat
+ 2011-07-15 13:18 . 2005-10-20 22:02 163328 c:\windows\erdnt\AutoBackup\7-15-2011\ERDNT.EXE
+ 2011-07-14 19:51 . 2011-07-14 19:51 339968 c:\windows\erdnt\AutoBackup\7-14-2011\Users\00000002\UsrClass.dat
+ 2011-07-14 19:51 . 2005-10-20 22:02 163328 c:\windows\erdnt\AutoBackup\7-14-2011\ERDNT.EXE
+ 2011-07-15 13:18 . 2011-07-15 13:18 21708800 c:\windows\erdnt\AutoBackup\7-15-2011\Users\00000001\NTUSER.DAT
+ 2011-07-14 19:51 . 2011-07-14 19:51 21708800 c:\windows\erdnt\AutoBackup\7-14-2011\Users\00000001\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 122512 —-a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2005-03-08 53248]
"VTTrayp"="VTtrayp.exe" [2005-08-04 163840]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb06.exe" [2008-01-16 188416]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2008-01-16 185896]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2008-01-16 75304]
"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2008-01-16 20480]
"ScanSoft OmniPage SE 4.0-reminder"="c:\program files\ScanSoft\OmniPageSE4.0\Ereg\Ereg.exe" [2008-01-16 1410600]
"WD Drive Manager"="c:\program files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe" [2008-05-17 430080]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-06-15 68592]
"QuickTime Task"="c:\application files\multimedia\video\quicktime\qttask.exe" [2009-01-06 413696]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2011-03-18 1043968]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-23 39264]
.
c:\documents and settings\Ike\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\Qualcomm\Eudora\EuShlExt.dll" [2006-08-18 86016]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]
backup=c:\windows\pss\Service Manager.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Ike^Start Menu^Programs^Startup^WinMySQLadmin.lnk]
backup=c:\windows\pss\WinMySQLadmin.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2005-06-07 09:46 57344 —-a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-05-12 09:12 49152 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]
2005-06-01 16:35 49152 —-a-w- c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-01-06 02:18 413696 —-a-w- c:\application files\Multimedia\Video\quicktime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-04-07 05:27 39408 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ColdFusion Management Service"=2 (0x2)
"ColdFusion Management Repository"=2 (0x2)
"ColdFusion Graphing Server"=2 (0x2)
"Cold Fusion RDS"=2 (0x2)
"Cold Fusion Executive"=2 (0x2)
"Cold Fusion Application Server"=2 (0x2)
"ClusterCATS Service"=2 (0x2)
"SQLServerAgent"=3 (0x3)
"MSSQLServer"=3 (0x3)
"gusvc"=3 (0x3)
"IISADMIN"=2 (0x2)
"ColdFusion MX 7 Search Server"=2 (0x2)
"ColdFusion MX 7 ODBC Server"=2 (0x2)
"ColdFusion MX 7 ODBC Agent"=2 (0x2)
"ColdFusion MX 7 Application Server"=2 (0x2)
"MySql"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
"c:\\Application Files\\Internet\\NewsReaders\\NewsBin\\nbpro.exe"=
"c:\\Application Files\\Internet\\Browsers\\Opera\\opera.exe"=
"c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [6/30/2011 8:06 PM 441176]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [4/5/2008 4:12 AM 309848]
R1 crlscsi;crlscsi;c:\windows\system32\drivers\crlscsi.sys [12/30/2005 6:36 AM 6144]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [4/5/2008 4:12 AM 19544]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\mcsacore.exe [11/28/2009 6:14 AM 88176]
R2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [5/16/2008 5:12 PM 102400]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [12/13/2008 12:21 PM 10976]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [3/31/2003 2:00 AM 14336]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [12/13/2008 12:46 PM 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [12/13/2008 12:46 PM 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [12/13/2008 12:46 PM 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys [12/13/2008 12:47 PM 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys [12/13/2008 12:47 PM 98568]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [6/16/2008 2:09 PM 11520]
S4 ColdFusion MX 7 Application Server;ColdFusion MX 7 Application Server;c:\cfusionmx7\runtime\bin\jrunsvc.exe [5/14/2007 6:32 AM 61440]
S4 ColdFusion MX 7 ODBC Agent;ColdFusion MX 7 ODBC Agent;c:\cfusionmx7\db\slserver54\bin\swagent.exe "ColdFusion MX 7 ODBC Agent" –> c:\cfusionmx7\db\slserver54\bin\swagent.exe ColdFusion MX 7 ODBC Agent [?]
S4 ColdFusion MX 7 ODBC Server;ColdFusion MX 7 ODBC Server;c:\cfusionmx7\db\slserver54\bin\swstrtr.exe "ColdFusion MX 7 ODBC Server" –> c:\cfusionmx7\db\slserver54\bin\swstrtr.exe ColdFusion MX 7 ODBC Server [?]
S4 ColdFusion MX 7 Search Server;ColdFusion MX 7 Search Server;c:\cfusionmx7\verity\k2\_nti40\bin\k2admin.exe [5/14/2007 6:31 AM 2732608]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 22:34]
.
2011-07-16 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 05:20]
.
2011-07-16 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-04 01:07]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = [removed] [removed] [removed]
DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} - hxxp://supportcenter.rr.com/sdccommon/download/tgctlins.cab
FF - ProfilePath - c:\documents and settings\Ike\Application Data\Mozilla\Firefox\Profiles\xaac7lao.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - d:\\Data Files\\Work Files\\WebsiteFiles\\HomePage\\Home.htm
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - c:\program files\McAfee\SiteAdvisor
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-15 19:26
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MySql]
"ImagePath"="C:/mysql/bin/mysqld-nt.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MySql]
"ImagePath"="C:/mysql/bin/mysqld-nt.exe"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\.application\bootstrap]
@DACL=(02 0000)
@="bootstrap.application.1"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(2800)
c:\windows\system32\WININET.dll
c:\progra~1\mcafee\SITEAD~1\saHook.dll
c:\program files\ScanSoft\OmniPageSE4.0\OpHookSE4.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\SmartFTP Client 2.0\smarthook.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\APC\APC PowerChute Personal Edition\mainserv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\VTTimer.exe
c:\windows\system32\VTtrayp.exe
c:\windows\system32\spool\drivers\w32x86\3\WrtProc.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2011-07-15 19:40:31 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-16 05:40
ComboFix2.txt 2011-07-15 23:08
ComboFix3.txt 2011-07-14 06:22
.
Pre-Run: 32,030,789,632 bytes free
Post-Run: 31,779,278,848 bytes free
.
Current=3 Default=3 Failed=2 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 6A4929AC9B10944F1AB3A18ED52A4D20