Hi! Ok here's the Combofix log I just made this morning:
ComboFix 12-07-21.01 - Compaq_Administrator 07/22/2012 7:02.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.959.477 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\docume~1\COMPAQ~1.MAR\LOCALS~1\Temp\IadHide5.dll
c:\documents and settings\Compaq_Administrator.MARIESCOMPUTER\Local Settings\Temp\IadHide5.dll
.
.
((((((((((((((((((((((((( Files Created from 2012-06-22 to 2012-07-22 )))))))))))))))))))))))))))))))
.
.
2012-07-18 21:26 . 2012-07-18 21:26 ——– d—–w- C:\tech help files
2012-07-17 20:08 . 2012-06-29 08:44 6891424 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{AFAB5BBE-AD67-4DB6-B149-3B0CA39717BB}\mpengine.dll
2012-07-14 19:51 . 2012-05-31 03:41 6762896 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-07-12 22:58 . 2012-07-03 16:21 353688 —-a-w- c:\windows\system32\drivers\aswSP.sys
2012-07-12 22:58 . 2012-07-03 16:21 21256 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-07-12 22:58 . 2012-07-03 16:21 54232 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2012-07-12 22:58 . 2012-07-03 16:21 35928 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2012-07-12 22:58 . 2012-07-03 16:21 721000 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2012-07-12 22:58 . 2012-07-03 16:21 97608 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2012-07-12 22:58 . 2012-07-03 16:21 89624 —-a-w- c:\windows\system32\drivers\aswmon.sys
2012-07-12 22:58 . 2012-07-03 16:21 25256 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2012-07-12 22:57 . 2012-07-03 16:21 41224 —-a-w- c:\windows\avastSS.scr
2012-07-12 22:57 . 2012-07-03 16:21 227648 —-a-w- c:\windows\system32\aswBoot.exe
2012-07-12 22:57 . 2012-07-12 22:57 ——– d—–w- c:\program files\AVAST Software
2012-07-12 22:57 . 2012-07-12 22:57 ——– d—–w- c:\documents and settings\All Users\Application Data\AVAST Software
2012-07-05 20:35 . 2012-07-05 20:35 ——– d—–w- c:\documents and settings\Administrator\Application Data\Template
2012-07-04 21:55 . 2012-07-04 21:55 ——– d—–w- c:\program files\Common Files\Software Update Utility
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-13 13:19 . 2004-08-10 04:00 1866112 —-a-w- c:\windows\system32\win32k.sys
2012-06-05 15:50 . 2011-12-21 11:46 1372672 —-a-w- c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2004-08-10 04:00 1172480 —-a-w- c:\windows\system32\msxml3.dll
2012-06-04 21:35 . 2011-12-22 10:32 222448 —-a-w- c:\windows\system32\muweb.dll
2012-06-04 04:32 . 2004-08-10 04:00 152576 —-a-w- c:\windows\system32\schannel.dll
2012-06-02 19:19 . 2009-08-07 00:24 22040 —-a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 19:19 . 2009-08-07 00:24 15384 —-a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 19:19 . 2004-08-10 04:00 329240 —-a-w- c:\windows\system32\wucltui.dll
2012-06-02 19:19 . 2004-08-10 04:00 219160 —-a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 19:19 . 2004-08-10 04:00 210968 —-a-w- c:\windows\system32\wuweb.dll
2012-06-02 19:19 . 2009-08-07 00:24 45080 —-a-w- c:\windows\system32\wups2.dll
2012-06-02 19:19 . 2009-08-07 00:24 15384 —-a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 19:19 . 2004-08-10 04:00 97304 —-a-w- c:\windows\system32\cdm.dll
2012-06-02 19:19 . 2004-08-10 04:00 53784 —-a-w- c:\windows\system32\wuauclt.exe
2012-06-02 19:19 . 2004-08-10 04:00 35864 —-a-w- c:\windows\system32\wups.dll
2012-06-02 19:19 . 2009-08-07 00:24 17944 —-a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 19:19 . 2004-08-10 04:00 577048 —-a-w- c:\windows\system32\wuapi.dll
2012-06-02 19:19 . 2004-08-10 04:00 1933848 —-a-w- c:\windows\system32\wuaueng.dll
2012-06-02 19:18 . 2011-12-22 10:32 275696 —-a-w- c:\windows\system32\mucltui.dll
2012-06-02 19:18 . 2011-12-22 10:32 17136 —-a-w- c:\windows\system32\mucltui.dll.mui
2012-05-31 13:22 . 2004-08-10 04:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2012-05-16 15:08 . 2004-08-10 04:00 916992 —-a-w- c:\windows\system32\wininet.dll
2012-05-11 14:42 . 2004-08-10 04:00 43520 ——w- c:\windows\system32\licmgr10.dll
2012-05-11 14:42 . 2004-08-10 04:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2004-08-10 04:00 385024 ——w- c:\windows\system32\html.iec
2012-05-04 13:16 . 2004-08-10 11:00 2148352 ——w- c:\windows\system32\ntoskrnl.exe
2012-05-04 12:32 . 2004-08-10 11:00 2026496 ——w- c:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46 . 2004-08-10 04:00 139656 ——w- c:\windows\system32\drivers\rdpwd.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-07-03 16:21 121528 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-07-12 39408]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe" [2012-01-04 6497592]
"Aim"="c:\program files\AIM\aim.exe" [2012-05-30 4331392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-07-03 4273976]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-08-08 180269]
"RTHDCPL"="RTHDCPL.EXE" [2009-02-03 18085888]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
"ISUSScheduler"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" [2004-07-28 81920]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-28 221184]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"ftutil2"="ftutil2.dll" [2004-06-07 106496]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-30 67584]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 77312]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\RIGHTEOUSCAFE\Start Menu\Programs\Startup\
PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-8-8 27136]
.
c:\documents and settings\Guest\Start Menu\Programs\Startup\
PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-8-8 27136]
.
c:\documents and settings\Hashabiah\Start Menu\Programs\Startup\
PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-8-8 27136]
.
c:\documents and settings\Hogla\Start Menu\Programs\Startup\
PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-8-8 27136]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Compaq Connections.lnk - c:\program files\Compaq Connections\5577497\Program\Compaq Connections.exe [2006-8-8 36903]
CompuServe 7.0 Tray Icon.lnk - c:\program files\CompuServe 7.0a\cstray.exe [2011-12-19 32840]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\CompuServe 7.0a\\wcs2000.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [7/12/2012 6:58 PM 721000]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [7/12/2012 6:58 PM 353688]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7/12/2012 6:58 PM 21256]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/12/2011 9:39 AM 136176]
S3 89A62723;89A62723;c:\windows\system32\89A62723.exe –> c:\windows\system32\89A62723.exe [?]
S3 F906712B;F906712B;c:\windows\system32\F906712B.exe –> c:\windows\system32\F906712B.exe [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [7/12/2011 9:39 AM 136176]
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]
.
2012-07-22 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-07-12 16:21]
.
2012-07-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-12 13:39]
.
2012-07-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-12 13:39]
.
2012-07-22 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-03-26 21:03]
.
2012-04-22 c:\windows\Tasks\switchShakeIcon.job
- c:\program files\NCH Software\Switch\switch.exe [2012-01-02 11:28]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
TCP: Interfaces\{80BEC499-54CA-464F-894B-277F1B8FD051}: NameServer = 205.188.146.145
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2012-07-22 07:16
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(800)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(3284)
c:\windows\system32\WININET.dll
c:\docume~1\COMPAQ~1.MAR\LOCALS~1\Temp\IadHide5.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\arservice.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\wanmpsvc.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\RTHDCPL.EXE
c:\windows\ARPWRMSG.EXE
c:\windows\eHome\ehmsas.exe
c:\progra~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2012-07-22 07:23:46 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-22 11:23
ComboFix2.txt 2012-07-17 22:02
.
Pre-Run: 218,953,388,032 bytes free
Post-Run: 219,019,399,168 bytes free
.
- - End Of File - - AD68ABDEF73950A14214189D35A2AE3B
