First I tried to remove the MyWebSearch. I saw it in the list and clicked Remove. It came back with an error - something like - Error loading C:/ProgramFiles/mywebs~1/bar/Ibin/mwsbar.dll The Specified module could not be located. ( i think i got that right, something could be misspelled though).
I am going to run that ATF Cleaner now, then start the Kaspersky Online Scanner. Assuming it is going to take a while, I will have to continue tomorrow.
Here is the result log from the ComboFix -..
ComboFix 07-09-13.1 - "Dave" 2007-09-14 21:43:13.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.517 [GMT -4:00]
Script execution time was exceeded on script "C:\ComboFix\restore_pt.vbs".
Script execution was terminated.
FILE::
C:\WINDOWS\system32\mpqss.ini2
C:\WINDOWS\system32\mpqss.bak2
C:\WINDOWS\system32\mpqss.bak1
C:\WINDOWS\system32\FCCB83B48.sys
C:\WINDOWS\system32\483BB8CC0F.sys
C:\windows\system32\lldsrngm.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\483BB8CC0F.sys
C:\WINDOWS\system32\mpqss.bak1
C:\WINDOWS\system32\mpqss.bak2
C:\WINDOWS\system32\mpqss.ini2
.
((((((((((((((((((((((((( Files Created from 2007-08-15 to 2007-09-15 )))))))))))))))))))))))))))))))
.
2007-09-12 19:31 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-12 07:21 d——– C:\DOCUME~1\Pam\APPLIC~1\Webroot
2007-09-11 22:29 23,864 –a—— C:\WINDOWS\system32\drivers\sskbfd.sys
2007-09-11 22:29 21,816 –a—— C:\WINDOWS\system32\drivers\sshrmd.sys
2007-09-11 22:29 20,280 –a—— C:\WINDOWS\system32\drivers\SSFS0BB8.sys
2007-09-11 22:29 163,128 –a—— C:\WINDOWS\system32\drivers\ssidrv.sys
2007-09-11 22:29 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\Webroot
2007-09-11 22:28 1,521,464 –a—— C:\WINDOWS\WRSetup.dll
2007-09-11 22:28 d——– C:\DOCUME~1\Dave\APPLIC~1\Webroot
2007-09-11 22:28 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Webroot
2007-09-11 22:27 164 –a—— C:\install.dat
2007-09-11 22:13 d——– C:\Program Files\Webroot
2007-09-10 21:17 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-09-10 18:09 d——– C:\DOCUME~1\Dave\APPLIC~1\McAfee
2007-09-10 11:12 d——– C:\Program Files\Common Files\Update
2007-09-09 17:12 d——– C:\DOCUME~1\TEMP\APPLIC~1\GTek
2007-09-09 17:11 d——– C:\DOCUME~1\TEMP\APPLIC~1\SiteAdvisor
2007-09-09 17:11 d——– C:\DOCUME~1\TEMP\APPLIC~1\Roxio
2007-09-09 17:11 d——– C:\DOCUME~1\TEMP\APPLIC~1\InstallShield
2007-09-09 17:09 d——– C:\DOCUME~1\TEMP\APPLIC~1\Google
2007-09-09 17:09 d——– C:\DOCUME~1\TEMP\APPLIC~1\Corel
2007-09-05 12:59 d——– C:\WINDOWS\system32\drvr2
2007-09-05 12:59 d——– C:\WINDOWS\system32\cfig322
2007-09-05 12:59 d——– C:\WINDOWS\system32\capcom
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-14 20:30 ——— d——– C:\Program Files\McAfee
2007-09-14 05:41 ——— d——– C:\Program Files\Common Files\McAfee
2007-09-10 18:09 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
2007-09-10 11:57 ——— d——– C:\DOCUME~1\Pam\APPLIC~1\SiteAdvisor
2007-09-07 08:05 ——— d——– C:\Program Files\SiteAdvisor
2007-09-07 07:39 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiteAdvisor
2007-09-04 08:57 ——— d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\SiteAdvisor
2007-08-26 20:43 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\X10 Settings
2007-08-06 22:39 ——— d——– C:\DOCUME~1\Dave\APPLIC~1\Wal-Mart Digital Photo Viewer
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\dllcache\wups.dll
2007-07-24 12:02 33800 –a—— C:\WINDOWS\system32\drivers\mferkdk.sys
2007-07-24 07:40 79304 –a—— C:\WINDOWS\system32\drivers\mfeavfk.sys
2007-07-21 09:08 40488 –a—— C:\WINDOWS\system32\drivers\mfesmfk.sys
2007-07-21 09:08 35240 –a—— C:\WINDOWS\system32\drivers\mfebopk.sys
2007-07-21 09:08 201288 –a—— C:\WINDOWS\system32\drivers\mfehidk.sys
2007-07-19 02:59 3583488 –a—— C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-12 19:31 765952 –a—— C:\WINDOWS\system32\dllcache\vgx.dll
2007-06-27 10:34 823808 –a—— C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-27 10:34 671232 –a—— C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-27 10:34 6058496 ——— C:\WINDOWS\system32\dllcache\ieframe.dll
2007-06-27 10:34 52224 ——— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-06-27 10:34 477696 –a—— C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-06-27 10:34 459264 ——— C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-06-27 10:34 44544 ——— C:\WINDOWS\system32\dllcache\iernonce.dll
2007-06-27 10:34 384512 ——— C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-06-27 10:34 383488 ——— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-06-27 10:34 27648 –a—— C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-06-27 10:34 267776 ——— C:\WINDOWS\system32\dllcache\iertutil.dll
2007-06-27 10:34 232960 ——— C:\WINDOWS\system32\dllcache\webcheck.dll
2007-06-27 10:34 230400 ——— C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-06-27 10:34 193024 –a—— C:\WINDOWS\system32\dllcache\msrating.dll
2007-06-27 10:34 153088 ——— C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-06-27 10:34 132608 –a—— C:\WINDOWS\system32\dllcache\extmgr.dll
2007-06-27 10:34 124928 ——— C:\WINDOWS\system32\dllcache\advpack.dll
2007-06-27 10:34 1152000 –a—— C:\WINDOWS\system32\dllcache\urlmon.dll
2007-06-27 10:34 105984 ——— C:\WINDOWS\system32\dllcache\url.dll
2007-06-27 10:34 102400 ——— C:\WINDOWS\system32\dllcache\occache.dll
2007-06-27 04:27 63488 ——— C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-06-27 04:27 625152 ——— C:\WINDOWS\system32\dllcache\iexplore.exe
2007-06-27 04:27 13824 ——— C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-06-27 03:00 161792 ——— C:\WINDOWS\system32\dllcache\ieakui.dll
2007-06-26 02:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-26 02:08 1104896 ——— C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 09:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-19 09:31 282112 ——— C:\WINDOWS\system32\dllcache\gdi32.dll
2006-10-05 00:16:56 104 –sh–r C:\WINDOWS\system32FCCB83B48.sys
.
((((((((((((((((((((((((((((( snapshot_2007-09-13_201938.89 )))))))))))))))))))))))))))))))))))))))))
.
—-a-w 32,768 2007-09-15 00:35:45 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
—-a-w 32,768 2007-09-15 00:35:45 C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
–sha-w 32,768 2007-09-15 00:35:45 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
—-atw 16,384 2007-09-15 00:30:27 C:\WINDOWS\Temp\Perflib_Perfdata_4bc.dat
.
—-a-w 32,768 2007-09-12 19:19:15 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
—-a-w 32,768 2007-09-12 19:19:15 C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
—-a-w 32,768 2007-09-12 19:19:15 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 16:01]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 19:48]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 02:20 C:\WINDOWS\stsystra.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 23:05]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 22:12]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 18:19]
"CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-09-15 11:47]
"MBMon"="CTMBHA.DLL" [2005-05-19 10:54 C:\WINDOWS\system32\CTMBHA.DLL]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 03:00]
"VoiceCenter"="C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [2005-09-19 09:42]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2006-01-27 00:18]
"ISUSPM Startup"="c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 05:40]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-09-11 05:40]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-01-27 00:26]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-02-18 22:21]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" [2005-09-09 01:18]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-27 21:58]
"DMXLauncher"="C:\Program Files\Roxio\Media Experience\DMXLauncher.exe" [2006-11-14 02:07]
"RoxioDragToDisc"="C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-11-15 10:05]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 11:22]
"PDF Converter Registry Controller"="C:\Program Files\ScanSoft\PDFConverter 2.0 Professional\PDFConv\\RegistryController.exe" [2004-08-18 03:49]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [2007-03-30 11:42]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-04 02:33]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-07-19 22:54]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 19:40 C:\WINDOWS\MIDIDEF.EXE]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 20:23]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24]
"Microsoft Location Finder"="C:\Program Files\Microsoft Location Finder\LocationFinder.exe" [2005-08-24 18:25]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 07:00]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 05:40]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" [2007-07-19 22:54]
C:\DOCUME~1\Dave\STARTM~1\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
R0 SSFS0BB8;Spy Sweeper File System Filer Driver: 0BB8;C:\WINDOWS\system32\Drivers\SSFS0BB8.SYS
R1 DLARTL_M;DLARTL_M;C:\WINDOWS\system32\Drivers\DLARTL_M.SYS
R3 sigfilt;sigfilt;C:\WINDOWS\system32\drivers\sigfilt.sys
R3 XUIF;X10 USB Wireless Transceiver;C:\WINDOWS\system32\Drivers\x10ufx2.sys
S2 IcRecUsb;IC Recorder Driver;C:\WINDOWS\system32\Drivers\IcRecUsb.sys
S3 SQLAgent$MICROSOFTBCM;SQLAgent$MICROSOFTBCM;C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlagent.EXE -i MICROSOFTBCM
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
AutoRun\command- J:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
AutoRun\command- E:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bdb8d942-0f1c-11dc-b1ca-00123fbfd523}]
AutoRun\command- J:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
"2007-05-10 00:51:32 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
"2007-05-10 00:51:31 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
.
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-09-14 22:32:11
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-09-14 22:38:38
C:\ComboFix-quarantined-files.txt … 2007-09-14 22:38
C:\ComboFix.txt … 2007-09-13 23:57
C:\ComboFix2.txt … 2007-09-13 20:28
C:\ComboFixResults_1.txt … 2007-09-13 20:30
.
— E O F —