Combofix log part 1

Question

ComboFix 08-10-16.08 - Mike Sheen 2008-10-17  9:12:20.1 - NTFSx86Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.1201 [GMT -6:00]Running from: C:\Documents and Settings\Mike Sheen\Desktop\ComboFix.exeCommand switches used :: C:\Documents and Settings\Mike Sheen\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe * Created a new restore point * Resident AV is active . (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))). C:	est.txtC:\WINDOWS\Downloaded Program Files\setup.inf .(((((((((((((((((((((((((((((((((((((((   Drivers/Services   ))))))))))))))))))))))))))))))))))))))))))))))))). -------\Legacy_PACKET-------\Service_Packet (((((((((((((((((((((((((   Files Created from 2008-09-17 to 2008-10-17  ))))))))))))))))))))))))))))))). 2008-10-14 19:51 . 2008-10-14 19:54 1,393 --a------ C:\WINDOWS\imsins.BAK2008-10-14 17:12 . 2008-09-08 04:41 333,824 --------- C:\WINDOWS\system32\dllcache\srv.sys2008-10-14 17:09 . 2008-09-15 06:12 1,846,400 --------- C:\WINDOWS\system32\dllcache\win32k.sys2008-10-14 17:08 . 2008-08-14 04:11 2,189,184 --------- C:\WINDOWS\system32\dllcache
toskrnl.exe2008-10-14 17:08 . 2008-08-14 04:09 2,145,280 --------- C:\WINDOWS\system32\dllcache
tkrnlmp.exe2008-10-14 17:08 . 2008-08-14 03:33 2,066,048 --------- C:\WINDOWS\system32\dllcache
tkrnlpa.exe2008-10-14 17:08 . 2008-08-14 03:33 2,023,936 --------- C:\WINDOWS\system32\dllcache
tkrpamp.exe2008-10-07 16:39 . 2008-10-07 16:39 0 --a------ C:\LOGB9.tmp2008-10-05 10:53 . 2008-10-05 10:53   d-------- C:\Program Files\CCleaner 2008-10-05 09:42 . 2008-10-05 09:42   d-------- C:\Program Files\SUPERAntiSpyware 2008-10-05 09:42 . 2008-10-05 09:42   d-------- C:\Documents and Settings\Mike Sheen\Application Data\SUPERAntiSpyware.com 2008-10-05 09:42 . 2008-10-05 09:42   d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-09-30 18:48 . 2008-09-30 18:48   d-------- C:\Documents and Settings\Mike Sheen\Application Data\Windows Desktop Search 2008-09-30 18:41 . 2008-09-30 18:41   d-------- C:\WINDOWS\system32\GroupPolicy 2008-09-30 18:41 . 2008-09-30 18:41   d-------- C:\Program Files\Windows Desktop Search 2008-09-30 18:40 . 2008-03-07 11:02 192,000 --------- C:\WINDOWS\system32\dllcache\offfilt.dll 2008-09-30 18:40 . 2008-03-07 11:02 98,304 --------- C:\WINDOWS\system32\dllcache
lhtml.dll 2008-09-30 18:40 . 2008-03-07 11:02 29,696 --------- C:\WINDOWS\system32\dllcache\mimefilt.dll 2008-09-30 17:20 . 2008-09-30 17:20   d-------- C:\Program Files\Personal Use .((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2008-10-15 00:18 --------- d-----w C:\Program Files\McAfee2008-10-14 23:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Dell2008-10-07 22:59 --------- d-----w C:\Documents and Settings\Mike Sheen\Application Data\U32008-10-05 16:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy2008-10-05 15:42 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard2008-10-04 16:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater2008-09-10 23:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Citrix2008-09-10 23:36 --------- d-----w C:\Program Files\Citrix2008-09-10 23:35 61,224 ----a-w C:\Documents and Settings\Mike Sheen\GoToAssistDownloadHelper.exe2008-09-10 23:20 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP2008-09-10 01:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys2008-08-23 02:07 --------- d-----w C:\Program Files\NetBeans 6.1 RC12008-08-18 23:45 --------- d-----w C:\Program Files\Microsoft Silverlight2008-08-17 22:39 --------- d-----w C:\Program Files\Western Digital2008-08-08 21:59 21,393 ----a-w C:\WINDOWS\AegisP.sys2008-05-14 23:05 56 --sh--r C:\WINDOWS\system32\7B517C9B8F.sys. (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]@='{747E722C-CB46-4A9D-BDFE-192AAD5099B1}'[HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4A9D-BDFE-192AAD5099B1}]2008-07-14 09:26 2405680 --a------ C:\Program Files\MozyHome\mozyshell.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]@='{EE6F5A00-7898-40F7-AB77-51FF9D6DEB20}'[HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40F7-AB77-51FF9D6DEB20}]2008-07-14 09:26 2405680 --a------ C:\Program Files\MozyHome\mozyshell.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'ctfmon.exe'='C:\WINDOWS\system32\ctfmon.exe' [2008-04-13 15360]'H/PC Connection Agent'='C:\Program Files\Microsoft ActiveSync\wcescomm.exe' [2006-11-13 1289000]'SUPERAntiSpyware'='C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe' [2008-09-03 1576176]'ModemOnHold'='C:\Program Files\NetWaiting
etWaiting.exe' [2003-09-10 20480]'Creative Detector'='C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe' [2004-12-02 102400]'SetDefaultMIDI'='MIDIDef.exe' [2004-12-22 C:\WINDOWS\MIDIDEF.EXE] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'UpdReg'='C:\WINDOWS\UpdReg.EXE' [2000-05-11 90112]'SynTPEnh'='C:\Program Files\Synaptics\SynTP\SynTPEnh.exe' [2005-11-28 761947]'SunJavaUpdateSched'='C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe' [2008-06-10 144784]'SiteAdvisor'='C:\Program Files\SiteAdvisor\6172\SiteAdv.exe' [2007-02-08 36904]'Share-to-Web Namespace Daemon'='C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe' [2002-04-11 69632]'mcagent_exe'='C:\Program Files\McAfee.com\Agent\mcagent.exe' [2007-11-01 582992]'dla'='C:\WINDOWS\system32\dla	fswctrl.exe' [2004-12-06 127035]'Dell QuickSet'='C:\Program Files\Dell\QuickSet\quickset.exe' [2007-02-20 1191936]'CTSysVol'='C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe' [2005-10-31 57344]'ATICCC'='C:\Program Files\ATI Technologies\ATI.ACE\cli.exe' [2005-08-12 45056]'Apoint'='C:\Program Files\Apoint2K\Apoint.exe' [2006-10-02 151552]'DellSupportCenter'='C:\Program Files\Dell Support Center\bin\sprtcmd.exe' [2008-08-14 206064]'dscactivate'='C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe' [2008-03-11 16384]'SigmatelSysTrayApp'='stsystra.exe' [2005-11-16 C:\WINDOWS\stsystra.exe] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2005-06-16 49152]Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-06-08 24576]HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]hp psc 2000 Series.lnk - C:\Program Files\HP\Digital Imaging\bin\hpobnz08.exe [2002-06-11 323646]Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-05-29 67128]Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-08-01 805392]MozyHome Status.lnk - C:\Program Files\MozyHome\mozystat.exe [2008-03-21 2311472]officejet 6100.lnk - C:\Program Files\HP\Digital Imaging\bin\hposol08.exe [2002-06-11 147456] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]'{56F9679E-7826-4C84-81F3-532071A8BCC5}'= 'C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll' [2008-05-26 304128]'{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}'= 'C:\Program Files\SUPERAntiSpyware\SASSEH.DLL' [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\!SASWinLogon]2008-07-23 16:28 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\GoToAssist]2008-09-10 17:36 10536 C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\LBTWlgn]2008-05-02 02:42 72208 c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]@='' [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Dell Network Assistant.lnk]path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell Network Assistant.lnkbackup=C:\WINDOWS\pss\Dell Network Assistant.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Service Manager.lnkbackup=C:\WINDOWS\pss\Service Manager.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VProperty.lnk]path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VProperty.lnkbackup=C:\WINDOWS\pss\VProperty.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnkbackup=C:\WINDOWS\pss\Windows Search.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Mike Sheen^Start Menu^Programs^Startup^MEMonitor.lnk]path=C:\Documents and Settings\Mike Sheen\Start Menu\Programs\Startup\MEMonitor.lnkbackup=C:\WINDOWS\pss\MEMonitor.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]--a------ 2007-03-09 11:09 63712 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]--a------ 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Readereader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]--a------ 2006-08-28 21:57 395776 C:\Program Files\Dell Support\DSAgnt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]--a------ 2008-08-14 00:04 206064 C:\Program Files\Dell Support Center\bin\sprtcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]--a------ 2005-01-27 00:02 86016 C:\Program Files\Dell\Media Experience\DMXLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate]--a------ 2008-03-11 12:44 16384 C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]--------- 2005-12-09 19:29 49152 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]--a------ 2008-09-02 15:37 29744 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]--a------ 2006-11-13 13:39 1289000 C:\Program Files\Microsoft ActiveSync\wcescomm.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]--a------ 2007-05-08 16:24 54840 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]--a------ 2007-07-25 16:30 974848 C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]--a------ 2007-07-25 16:32 823296 C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]--a------ 2005-06-10 09:44 249856 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]--a------ 2005-06-10 09:44 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]--a------ 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg	gcmd]-ra------ 2005-02-03 18:38 1851392 C:\Program Files\Support.com\bin	gcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoiceCenter]--------- 2006-01-02 08:13 1126400 C:\Program Files\Creative\VoiceCenter\AndreaVC.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WD Drive Manager]--a------ 2008-01-30 04:50 438272 C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]--a------ 2007-08-30 18:43 4670704 C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]'gusvc'=2 (0x2)'GoogleDesktopManager-061008-081103'=3 (0x3)'GameConsoleService'=3 (0x3)'aawservice'=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center]'AntiVirusDisableNotify'=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]'DisableMonitoring'=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]'DisableMonitoring'=dword:00000001

skwidlie · Answer

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]'%windir%\system32\sessmgr.exe'='C:\Program Files\Messenger\msmsgs.exe'='%windir%\Network Diagnostic\xpnetdiag.exe'='C:\Program Files\Microsoft ActiveSyncapimgr.exe'= C:\Program Files\Microsoft ActiveSyncapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager'C:\Program Files\Microsoft ActiveSync\wcescomm.exe'= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager'C:\Program Files\Microsoft ActiveSync\WCESMgr.exe'= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application'C:\Documents and Settings\Mike Sheen\Desktop\eclipse\eclipse.exe'='C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe'='C:\Program Files\Yahoo!\Messenger\YServer.exe'='C:\Program Files\MSN Messenger\msnmsgr.exe'='C:\Program Files\MSN Messenger\livecall.exe'='C:\Program Files\Java\jdk1.6.0_03\bin\java.exe'='C:\Program Files\Java\jre1.6.0_05\bin\java.exe'='C:\Program Files\Java\jdk1.6.0_03\jre\bin\java.exe'='C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe'='C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe'='C:\Program Files\Dell Network Assistant\ezi_hnm2.exe'= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]'26675:TCP'= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service'10421:UDP'= 10421:UDP:SingleClick Discovery Protocol'10426:UDP'= 10426:UDP:SingleClick ICC'1700:TCP'= 1700:TCP:MioNet Remote Drive Access'1641:TCP'= 1641:TCP:MioNet Remote Drive Verification R1 mozyFilter;mozyFilter;C:\WINDOWS\system32\DRIVERS\mozy.sys [2008-07-14 53752]R2 NwSapAgent;SAP Agent;C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]R2 WDBtnMgrSvc.exe;WD Drive Manager Service;C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [2008-01-30 106496]S3 DMService;Whale Component Manager;C:\WINDOWS\DOWNLO~1\DMService.exe [2008-02-15 423576]S3 GoToAssist;GoToAssist;C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe Start=service [ ]S3 SPC610NC;SPC 610NC Laptop Camera;C:\WINDOWS\system32\DRIVERS\SPC610NC.SYS [2005-10-13 156800]S4 GameConsoleService;GameConsoleService;C:\Program Files\WildTangent\Apps\Dell Game Console\GameConsoleService.exe [2007-09-11 181784]S4 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-02 29744] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20be524e-6cad-11dd-acd6-0016415e3245}]\Shell\AutoRun\command - E:\wd_windows_tools\WDEULA.exe.Contents of the 'Scheduled Tasks' folder 2008-05-14 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57] 2008-06-15 C:\WINDOWS\Tasks\McDefragTask.job- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32] 2008-09-01 C:\WINDOWS\Tasks\McQcTask.job- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]..------- Supplementary Scan -------.FireFox -: Profile - C:\Documents and Settings\Mike Sheen\Application Data\Mozilla\Firefox\Profiles\9t1wm2or.default\FF -: plugin - C:\Program Files\Google\Google Updater\2.2.1229.1533
pCIDetect11.dllFF -: plugin - C:\Program Files\Mozilla Firefox\plugins
pGoogleGadgetPluginFirefoxWin.dllFF -: plugin - C:\Program Files\Viewpoint\Viewpoint Experience Technology
pViewpoint.dllFF -: plugin - C:\Program Files\Virtual Earth 3D
pVE3D.dllFF -: plugin - C:\Program Files\Yahoo!\Shared
pYState.dll. ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2008-10-17 09:17:05Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0 **************************************************************************.--------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe-> C:\Program Files\SiteAdvisor\6172\saHook.dll-> C:\Program Files\MozyHome\mozyshell.dll.------------------------ Other Running Processes ------------------------.C:\WINDOWS\system32\ati2evxx.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\WINDOWS\system32\ati2evxx.exeC:\PROGRA~1\MI3AA1~1apimgr.exeC:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exeC:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exeC:\WINDOWS\system32\CTSVCCDA.EXEC:\Program Files\Apoint2K\ApntEx.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exeC:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exeC:\Program Files\Dell Network Assistant\hnm_svc.exeC:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exeC:\PROGRA~1\McAfee\MSC\mcmscsvc.exeC:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exeC:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exeC:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exeC:\Program Files\Common Files\McAfee\MNA\McNASvc.exeC:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exeC:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exeC:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exeC:\Program Files\MozyHome\mozybackup.exeC:\Program Files\McAfee\MPF\MpfSrv.exeC:\Program Files\McAfee\MSK\msksrver.exeC:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exeC:\Program Files\HP\Digital Imaging\bin\hpqste08.exeC:\WINDOWS\system32\HPZipm12.exeC:\Program Files\Intel\Wireless\Bin\RegSrvc.exeC:\Program Files\Dell Support Center\bin\sprtsvc.exeC:\WINDOWS\system32\PAStiSvc.exeC:\Program Files\Intel\Wireless\Bin\WLKEEPER.exeC:\WINDOWS\system32\searchindexer.exeC:\WINDOWS\system32\wbem\wmiapsrv.exeC:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe.**************************************************************************.Completion time: 2008-10-17  9:25:23 - machine was rebootedComboFix-quarantined-files.txt  2008-10-17 15:25:16 Pre-Run: 26,933,846,016 bytes freePost-Run: 27,053,060,096 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe[boot loader]timeout=2default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS[operating systems]C:\CMDCONS\BOOTSECT.DAT='Microsoft Windows Recovery Console' /cmdconsmulti(0)disk(0)rdisk(0)partition(2)\WINDOWS='Microsoft Windows XP Professional' /noexecute=optin /fastdetect 298 --- E O F --- 2008-10-15 01:54:28     I apologize if I did this wrong, but I couldn't get the whole log into one post... Could someone review it and tell me if I need to do anything else.   Thanks

Bugbatter · Answer

This is the HijackThis Board. Instructions for posting are at the top of the forum.

You should not be using Combofix unless you have been instructed to do so by a Malware Removal Expert. It is a powerful tool intended by its creator to be "used under the guidance and supervision of an expert", NOT for private use.
Please read Combofix's Disclaimer:

Here are just two examples of the consequences of using Combofix without supervision.
http://forums.us.dell.com/supportforums/board/message?board.id=si_virus&thread.id=67009
http://forums.cnet.com/5208-6132_102-0.html?forumID=32&threadID=293341&messageID=2763333#2763333

skwidlie · Answer

Thank you bugbatter... I was told to try this software by a Dell technician, I was wondering what you would suggest would be a better alternative to combofix? I'm just getting tired of my computer locking up.

Thanks

Bugbatter · Answer

If a Dell Tech told you to run ComboFix, why did you not send him the results for analysis? I suggest that you contact him again and ask him to continue in this topic.

skwidlie · Answer

I'll contact him and do that, he had just told me to follow the instructions and one of them was to post to this forum. Thanks for your help.:smileywink:

Virus & Spyware

Combofix log part 1

Was this post helpful?