Possible Malware-related problems, need help with diagnosing and fixing

I recall seeing something in the last combofix scan log that indicated you had recently installed AVPersonal...and you still have mcafee too. That's not a good idea to run two antivirus applications on board in real time but I don't see it running in your log. On your next reply perhaps you can solve the mystery.

OK...did you run option 2 again after the reboot like the application directed?
The log looks clean now but as I recall there's a legacy & driver from the combofix scan that we need to remove...

Please open a blank Notepad by clicking start-->run
Then, in the run box type Notepad.exe and click "OK".
Copy the below text in Bold and paste it into the blank Notepad. Save it as CFScript.txt...Change the Save as type to All Files and save it to your desktop. Now drag the text document over to your Combofix.exe

Combofix will run again automatically. Please post back the new log that will be generated. Thanks!


Driver::
asc355


Registry::
[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\asc355]
[-HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_ASC355]

ComboFix log:

ComboFix 07-09-08.7 - "alf82" 2007-09-14 22:22:28.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.85 [GMT -4:00]
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_ASC355
-------\asc355


((((((((((((((((((((((((( Files Created from 2007-08-15 to 2007-09-15 )))))))))))))))))))))))))))))))
.

2007-09-13 01:47 2,856 --a------ C:\WINDOWS\SYSTEM32\tmp.reg
2007-09-13 01:32 d-------- C:\SmitfraudFix
2007-09-09 16:11 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
2007-09-09 16:10 75,932 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\klick.dat
2007-09-09 16:10 75,248 --a------ C:\WINDOWS\zllsputility.exe
2007-09-09 16:10 74,396 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\klin.dat
2007-09-09 16:10 4,212 ---h----- C:\WINDOWS\SYSTEM32\zllictbl.dat
2007-09-09 16:10 14,368 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat
2007-09-09 16:10 11,264 --a------ C:\WINDOWS\SYSTEM32\SpOrder.dll
2007-09-09 16:10 1,568 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.dat
2007-09-09 16:08 d-------- C:\WINDOWS\Internet Logs
2007-09-08 16:44 10,872 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2007-09-08 14:27 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-08 11:18 d-------- C:\security
2007-09-08 08:36 d-------- C:\VundoFix Backups
2007-09-02 22:19 d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Real
2007-09-02 22:04 86,016 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\pctspk.exe
2007-09-02 22:04 86,016 --a------ C:\WINDOWS\SYSTEM32\pctspk.exe
2007-09-02 21:54 d-------- C:\DOCUME~1\Annie\APPLIC~1\Real
2007-09-02 21:35 41,600 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\weitekp9.dll
2007-09-02 21:35 31,232 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\weitekp9.sys
2007-09-02 21:22 489,984 --a------ C:\WINDOWS\SYSTEM32\hypertrm.dll
2007-09-02 21:22 200,704 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\wordpad.exe
2007-09-02 21:22 189,440 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\wuaueng.dll
2007-09-02 21:22 189,440 --a------ C:\WINDOWS\SYSTEM32\wuaueng.dll
2007-09-02 21:22 139,776 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\wuauclt.exe
2007-09-02 21:22 139,776 --a------ C:\WINDOWS\SYSTEM32\wuauclt.exe
2007-09-02 21:11 24,661 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\spxcoins.dll
2007-09-02 21:11 24,661 --a------ C:\WINDOWS\SYSTEM32\spxcoins.dll
2007-09-02 21:11 13,312 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\irclass.dll
2007-09-02 21:11 13,312 --a------ C:\WINDOWS\SYSTEM32\irclass.dll
2007-09-02 19:19 593,408 --a------ C:\WINDOWS\SYSTEM32\xpsp2res.dll
2007-09-02 19:16 6,550 --a------ C:\WINDOWS\jautoexp.dat
2007-09-02 19:15 113 --a------ C:\WINDOWS\SYSTEM32\zonedon.reg
2007-09-02 19:15 113 --a------ C:\WINDOWS\SYSTEM32\zonedoff.reg
2007-09-02 17:11 d-------- C:\DOCUME~1\ANNIEF~1\APPLIC~1\Roxio
2007-09-01 13:09 76,016 --a------ C:\Program Files\setup.exe
2007-09-01 10:11 d-------- C:\Program Files\Trend Micro
2007-08-31 22:31 d-------- C:\Program Files\Spybot
2007-08-31 22:31 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-08-31 21:50 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-08-31 21:41 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-08-16 22:38 d-------- C:\Program Files\iTunes
2007-08-16 22:31 d-------- C:\Program Files\QuickTime
2007-08-16 22:24 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-09 16:16 1244 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2007-09-09 16:16 1196 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2007-08-31 21:50 --------- d-------- C:\Program Files\Lavasoft
2007-08-31 21:45 --------- d-------- C:\DOCUME~1\ANNIEF~1\APPLIC~1\Lavasoft
2007-08-31 20:23 --------- d-------- C:\Program Files\McAfee
2007-08-22 08:10 --------- d-------- C:\Program Files\Opera
2007-08-16 22:38 --------- d-------- C:\Program Files\iPod
2007-08-16 22:24 --------- d-------- C:\Program Files\Apple Software Update
2007-08-12 16:28 --------- d-------- C:\Program Files\Microsoft AntiSpyware
2007-08-12 16:23 --------- d-------- C:\Program Files\AVPersonal
2007-08-12 16:18 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
2007-08-12 16:17 --------- d-------- C:\Program Files\Common Files\Cisco Systems
2007-08-12 16:15 --------- d-------- C:\Program Files\Common Files\McAfee
2007-08-12 16:07 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee.com
2007-08-12 15:56 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
2007-08-07 13:58 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-07 13:56 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
.

((((((((((((((((((((((((((((( snapshot_2007-09-08_144128.67 )))))))))))))))))))))))))))))))))))))))))
.
----a-w 345,656 2006-07-11 13:41:36 C:\WINDOWS\Downloaded Program Files\ewidoOnlineScan.dll
----a-w 796,048 2007-06-22 01:54:26 C:\WINDOWS\SYSTEM32\libeay32_0.9.6l.dll
----a-w 83,432 2007-06-22 01:54:30 C:\WINDOWS\SYSTEM32\vsdata.dll
----a-w 394,984 2007-06-22 01:54:52 C:\WINDOWS\SYSTEM32\vsdatant.sys
----a-w 157,160 2007-06-22 01:54:32 C:\WINDOWS\SYSTEM32\vsinit.dll
----a-w 103,912 2007-06-22 01:54:32 C:\WINDOWS\SYSTEM32\vsmonapi.dll
----a-w 275,944 2007-06-22 01:54:32 C:\WINDOWS\SYSTEM32\vspubapi.dll
----a-w 71,144 2007-06-22 01:54:32 C:\WINDOWS\SYSTEM32\vsregexp.dll
----a-w 472,552 2007-06-22 01:54:34 C:\WINDOWS\SYSTEM32\vsutil.dll
----a-w 46,568 2007-06-22 01:54:34 C:\WINDOWS\SYSTEM32\vswmi.dll
----a-w 99,816 2007-06-22 01:54:34 C:\WINDOWS\SYSTEM32\vsxml.dll
----a-w 83,432 2007-06-22 01:54:34 C:\WINDOWS\SYSTEM32\zlcomm.dll
----a-w 71,144 2007-06-22 01:54:34 C:\WINDOWS\SYSTEM32\zlcommdb.dll
----a-w 1,086,952 2007-06-22 01:54:40 C:\WINDOWS\SYSTEM32\zpeng24.dll
----a-w 262,144 2007-09-15 02:21:49 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\ntuser.dat
----a-w 32,768 2007-09-15 00:01:58 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\INDEX.DAT
----a-w 32,768 2007-09-15 00:01:58 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\INDEX.DAT
----a-w 32,768 2007-09-15 00:01:58 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
----a-w 110,360 2007-05-31 04:03:48 C:\WINDOWS\SYSTEM32\DRIVERS\kl1.sys
----a-w 175,376 2007-05-31 04:03:48 C:\WINDOWS\SYSTEM32\DRIVERS\klif.sys
----a-r 190,696 2007-06-11 17:04:38 C:\WINDOWS\SYSTEM32\Macromed\Flash\FlashUtil9d.exe
----a-w 366,112 2007-06-22 01:54:24 C:\WINDOWS\SYSTEM32\ZoneLabs\av.dll
----a-w 99,816 2007-06-22 01:54:24 C:\WINDOWS\SYSTEM32\ZoneLabs\camupd.dll
----a-w 813,568 2004-01-30 16:35:08 C:\WINDOWS\SYSTEM32\ZoneLabs\dbghelp.dll
----a-w 128,480 2007-06-22 01:54:24 C:\WINDOWS\SYSTEM32\ZoneLabs\fbl.dll
----a-w 38,376 2007-06-22 01:54:26 C:\WINDOWS\SYSTEM32\ZoneLabs\featuremap.dll
----a-w 321,016 2007-06-22 01:54:26 C:\WINDOWS\SYSTEM32\ZoneLabs\imsecure.dll
----a-w 714,472 2007-06-11 16:43:50 C:\WINDOWS\SYSTEM32\ZoneLabs\qrbase.dll
----a-w 788,200 2007-06-11 16:43:52 C:\WINDOWS\SYSTEM32\ZoneLabs\qrsrecl.dll
----a-w 173,544 2007-06-22 01:54:28 C:\WINDOWS\SYSTEM32\ZoneLabs\scheduler.dll
----a-w 2,432,259 2007-01-11 15:12:08 C:\WINDOWS\SYSTEM32\ZoneLabs\spyware.dat
----a-w 1,496,808 2007-06-11 16:43:56 C:\WINDOWS\SYSTEM32\ZoneLabs\srescan.dll
----a-w 50,416 2007-06-11 16:44:10 C:\WINDOWS\SYSTEM32\ZoneLabs\srescan.sys
----a-w 456,168 2007-06-22 01:54:28 C:\WINDOWS\SYSTEM32\ZoneLabs\ssleay32.dll
----a-w 833,248 2007-09-09 21:17:27 C:\WINDOWS\SYSTEM32\ZoneLabs\updating.dll
----a-w 144,936 2007-06-22 01:54:46 C:\WINDOWS\SYSTEM32\ZoneLabs\updclient.exe
----a-w 286,787 2007-01-11 21:31:06 C:\WINDOWS\SYSTEM32\ZoneLabs\updtrsdk.dll
----a-w 503,875 2006-09-05 00:59:14 C:\WINDOWS\SYSTEM32\ZoneLabs\upd_core.dll
----a-w 108,008 2007-06-22 01:54:30 C:\WINDOWS\SYSTEM32\ZoneLabs\vsavpro.dll
----a-w 79,336 2007-06-22 01:54:30 C:\WINDOWS\SYSTEM32\ZoneLabs\vsdb.dll
----a-w 75,304 2007-06-22 01:54:46 C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
----a-w 2,024,936 2007-06-22 01:54:32 C:\WINDOWS\SYSTEM32\ZoneLabs\vsmondll.dll
----a-w 1,345,000 2007-06-22 01:54:32 C:\WINDOWS\SYSTEM32\ZoneLabs\vsruledb.dll
----a-w 243,176 2007-06-22 01:54:34 C:\WINDOWS\SYSTEM32\ZoneLabs\vsvault.dll
----a-w 2,432,259 2007-01-11 15:12:08 C:\WINDOWS\SYSTEM32\ZoneLabs\zlasdbup.dat
----a-w 177,640 2007-06-22 01:54:36 C:\WINDOWS\SYSTEM32\ZoneLabs\zlparser.dll
----a-w 79,344 2007-06-22 01:54:36 C:\WINDOWS\SYSTEM32\ZoneLabs\zlquarantine.dll
----a-w 378,344 2007-06-22 01:54:36 C:\WINDOWS\SYSTEM32\ZoneLabs\zlsre.dll
----a-w 120,296 2007-06-22 01:54:36 C:\WINDOWS\SYSTEM32\ZoneLabs\zlupdate.dll
----a-w 77,824 2007-05-31 04:03:16 C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\CKAHComm.dll
----a-w 110,592 2007-05-31 04:03:16 C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\CKAHrule.dll
----a-w 331,776 2007-05-31 04:03:16 C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\CKAHUM.dll
----a-w 38,400 2007-05-31 04:03:16 C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\FSSync.dll
----a-w 208,960 2006-09-20 03:12:14 C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\inv.dll
----a-w 258,048 2007-05-31 04:03:16 C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\kave.dll
----a-w 175,376 2007-05-31 04:03:48 C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\klif_32.sys
----a-w 1,093,632 2006-12-19 22:13:52 C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\libeay32.dll
----a-w 548,864 2007-05-31 04:03:20 C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\msvcp80.dll
----a-w 626,688 2007-05-31 04:03:20 C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\msvcr80.dll
----a-w 184,320 2007-05-31 04:03:18 C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\prloader.dll
----a-w 90,112 2007-05-31 04:03:22 C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\prremote.dll
----a-w 118,784 2007-05-31 04:03:18 C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\ScanningProcess.exe
----a-w 200,704 2006-12-19 22:13:52 C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\ssleay32.dll
----a-w 65,248 2007-05-31 04:03:30 C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\bases\aphish.dat
----a-w 21,568 2006-06-30 18:47:36 C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\bases\avcmhk4.dll
----a-w 288,144 2007-06-22 01:54:54 C:\WINDOWS\SYSTEM32\ZoneLabs\lib\ConfigWizard.zip.dll
----a-w 152,976 2007-06-22 01:54:54 C:\WINDOWS\SYSTEM32\ZoneLabs\lib\licenseui.zip.dll
----a-w 26,000 2007-06-22 01:54:54 C:\WINDOWS\SYSTEM32\ZoneLabs\lib\zlsvc.zip.dll
----a-w 1,361,296 2007-06-22 01:54:54 C:\WINDOWS\SYSTEM32\ZoneLabs\lib\zpy.zip.dll
----a-w 71,056 2007-06-22 01:54:54 C:\WINDOWS\SYSTEM32\ZoneLabs\lib\zui.zip.dll
----a-w 30,184 2007-06-22 01:56:16 C:\WINDOWS\SYSTEM32\ZoneLabs\plugins\rpc_server\rpc_server.dll
----a-w 30,216 2007-06-22 01:56:16 C:\WINDOWS\SYSTEM32\ZoneLabs\plugins\vsmon_plugin\vsmon_plugin.dll
----a-w 210,432 2007-06-22 01:56:16 C:\WINDOWS\SYSTEM32\ZoneLabs\streamapi\httpblocker\httpblocker.dll
----a-w 3,229,176 2007-06-22 01:56:18 C:\WINDOWS\SYSTEM32\ZoneLabs\streamapi\imslsp\imslsp.dll
----a-w 32,768 2007-09-13 05:44:59 C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat
.
----a-w 262,144 2007-09-08 18:27:52 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\ntuser.dat
----a-w 32,768 2007-09-08 12:36:22 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\INDEX.DAT
----a-w 32,768 2007-09-08 12:36:22 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\INDEX.DAT
----a-w 32,768 2007-09-08 12:36:25 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2003-09-25 19:53]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2006-11-30 08:50]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 13:39]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-31 18:44]
"AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 15:53]
"PCTVOICE"="pctspk.exe" [2001-08-17 22:36 C:\WINDOWS\SYSTEM32\pctspk.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2003-05-02 18:21]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2003-05-02 18:15]
"ATIModeChange"="Ati2mdxx.exe" [2002-08-28 18:17 C:\WINDOWS\SYSTEM32\Ati2mdxx.exe]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" []

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"tscuninstall"=%systemroot%\system32\tscupgrd.exe

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2007-09-02 21:28:16]

C:\DOCUME~1\ADMINI~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2007-09-02 21:28:16]

C:\DOCUME~1\ANNIEF~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]

C:\DOCUME~1\Annie\STARTM~1\Programs\Startup\
DESKTOP.INI [2007-09-02 21:28:16]

C:\DOCUME~1\DEFAUL~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2007-09-02 21:28:16]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 8.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 8.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL Companion.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL Companion.lnk
backup=C:\WINDOWS\pss\AOL Companion.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
"C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange]
Ati2mdxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
C:\Program Files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry]
C:\WINDOWS\System32\DSentry.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E6TaskPanel]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
C:\Program Files\McAfee.com\Agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
"C:\Program Files\Microsoft Money\System\mnyexpr.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE]
pctspk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WLTRYSVC"=2 (0x2)
"WANMiniportService"=2 (0x2)
"MCVSRte"=2 (0x2)
"McShield"=3 (0x3)
"iPodService"=3 (0x3)
"Ati HotKey Poller"=2 (0x2)

R1 cdudf_xp;cdudf_xp;C:\WINDOWS\System32\drivers\cdudf_xp.sys
R1 mfetdik;McAfee Inc.;C:\WINDOWS\System32\drivers\mfetdik.sys
R1 pwd_2k;pwd_2k;C:\WINDOWS\System32\drivers\pwd_2k.sys
R1 UdfReadr_xp;UdfReadr_xp;C:\WINDOWS\System32\drivers\UdfReadr_xp.sys
R3 mfeapfk;McAfee Inc.;C:\WINDOWS\System32\drivers\mfeapfk.sys
R3 mmc_2K;mmc_2K;C:\WINDOWS\System32\drivers\mmc_2K.sys
S3 dvd_2K;dvd_2K;C:\WINDOWS\System32\drivers\dvd_2K.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-08-17 02:25:13 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-14 22:29:10
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\asc355O]

.
Completion time: 2007-09-14 22:31:47 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-14 22:31
.
--- E O F ---

HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:45:35 PM, on 9/14/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1188195863193
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1188195832018
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe (file missing)

--
End of file - 5421 bytes

Once again your hjt log looks clean but the problem driver is still showing up in the cf scan log. Going down the check list:

1) Did you run the option 2 from SmitFraudFix scan prior to the last combofix script fix?
2) Have you disabled any programs or processes from starting using the msconfig utility?
3) Have you disabled protective software that may interfere with system changes...such as AVG Anti-Spyware's guard as was instructed during it's installation, from post # 9 on page 1?

QUOTE: "1) Did you run the option 2 from SmitFraudFix scan prior to the last combofix script fix?"

Yes, in safe mode.

QUOTE: "2) Have you disabled any programs or processes from starting using the msconfig utility?"

No. I've never used the MSConfig Utility. McAfee starts on startup, not sure about other programs/processes.

QUOTE: "3) Have you disabled protective software that may interfere with system changes...such as AVG Anti-Spyware's guard as was instructed during it's installation, from post # 9 on page 1?"

I followed the instructions to the letter. But since we never AVG Anti-Spyware to work as you'll recall, I uninstalled it, figuring I can reinstall it later once I'm clean.

Thanks very much 1972vet...I appreciate your continuing help and support. I look forward to hearing more. Please let me know if you need any additional information from me.

Thanks for the reply alf...I'm researching this and have also requested some of the other experts here to join in.

At the moment, I'm stumped as to the way your cf scan log appears. The questionable driver appears in a location that I'm not accustomed to seeing.

While I continue to look into your issues, I will get back to you with further instructions after I consult with some of these other volunteers opinion's of these matters.

Thanks very much for your patience!

OK, it's been long enough I think...I haven't gotten any working responses from anyone so let's move on.

I have two other thoughts about a new approach we should take. One, I'd like to see if killbox would remove the hidden driver...and if not, then I'd like to see a gmer scan log.

Please download the KILLBOX.Extract it to your desktop.
DO NOTHING ELSE WITH IT YET.

First let me point out that we were indeed successful in removing the hidden driver asc355 with the last combofix script run. To this point, the malware you HAD on your system was calling back the download. This time however, when the hidden driver returned, it changed it's name to asc355O. That tells me at least, we've made SOME progress.

Let's do this...earlier I had requested that you download and install the AVG Anti-Spyware but you had problems with it, I'm certain, because of all the malware still remaining on the system at that time.

We have since removed quite a bit. Please make another attempt to download and install the AVG Anti-Spyware v7.5 application again following these instructions:

• 
  
• After download, double click on the file to launch the install process.
• Choose a language, click "OK" and then click "Next".
• Read the "License Agreement" and click "I Agree".
• Accept default installation path: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5, click "Next", then click "Install".
• After setup completes, click "Finish" to start the program automatically or launch AVG Anti-Spyware by double-clicking its icon on your desktop or in the system tray.
• The main "Status" menu will appear. Select "Change state" to inactivate 'Resident Shield' and 'Automatic Updates'. As AVG Anti-Spyware may interfere with some of our other fixes, we are temporarily disabling its active protection features until your system is clean, then you can re-enable them.
• Then right click on AVG Anti-Spyware in the system tray and uncheck "Start with Windows".
• Connect to the Internet, go back to AVG Anti-Spyware, select the "Update" button and click "Start update".
• Wait until you see the " Update successful" message. If you are having problems with the updater, manually download and update with the AVG Anti-Spyware Full database installer.
  
• Exit AVG Anti-Spyware when done - DO NOT perform a scan yet.

Reboot the computer into Safe mode.


Scan with AVG Anti-Spyware as follows:

• Click on the "Scanner" button and choose the "Settings" tab.
• 
  
• Under "How to act?", click on "Recommended actions" and choose "Quarantine" to set default action for detected malware.
• Under "How to Scan?", "Possibly unwanted software", and What to Scan?" leave all the default settings.
• Under "Reports" select "Automatically generate report after every scan" and uncheck "Only if threats were found".
• Click the "Scan" tab to return to scanning options.
• Click "Complete System Scan" to start.
• 
  >DO NOT USE the computer while AVG Anti-Spyware is scanning. Doing so can hamper AVG Anti-Spyware's ability to clean properly and may result in reinfection.
  
• When the scan has finished, it should automatically be set to Quarantine--if not click on Recommended Action and set it there.
• You will also be presented with a list of infected objects found. Click "Apply all actions" to place the files in Quarantine.

IMPORTANT! Do not save the report before you have clicked the :Apply all actions button. If you do, the log that is created will indicate "No action taken", making it more difficult to interpret the report. So be sure you save it only AFTER clicking the "Apply all actions" button.

• Click on "Save Report" to view all completed scans. Click on the most recent scan you just performed and select "Save report as" - the default file name will be in date/time format as follows: Report-Scan-20060620-142816.txt. Save to your desktop. A copy of each report will also be saved in C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Reports\
• Exit AVG Anti-Spyware when done.
• 
  
  Open killbox.exe.
  
  First click on Tools-->Delete Temp Files.
  A box will open with a list of all user profiles.
  
  Check the following boxes at a minimum for each profile by clicking on the drop down and checking the boxes that are enabled. Some will not apply and those boxes will not be available to check. Make sure you do this for all the profiles listed.
  
  Temporary Internet Files
  Temp Files
  XP Prefetch
  
  If you want to clean your cookies, history, and list of recent files run you may check those boxes as well.
  
  Then, click on the Button titled "Delete Selected Temp Files".
  Exit by clicking the Button titled "Exit(Save Settings)".
  
  Once back into the main killbox program, check the box:
  
  Delete on Reboot
  
  Highlight the entry below in Bold text and then copy it.
  
  C:\Windows\System32\asc355O
  
  Then in killbox click File-->Paste from Clipboard
  
  Click the "All Files" button.
  
  Then click the Red X ...and for the confirmation message that will appear, you will need to click Yes.
  
  A second message will ask to Reboot now? you will need to click YES to allow the reboot.
  Note: Killbox will let you know if a file does not exist.
  

Post back the AVG Anti-Spyware scan log along with a fresh HijackThis log. Please advise how the computer is behaving and if you have noticed any other issues. Thanks for your patience!

Run through the killbox instruction again and reboot manually in spite of the error message. Post your results. Your HijackThis log still looks just fine...but you and I both know the hidden driver problem may still exist. In the interest of keeping the casual forum readers up-to-date, I am posting here in the public forum some excerpts from the private messages that we traded for their benefit in the event that other users may be experiencing these same issues:
Quote:
asc3550

Thanks for the reply post! I look forward to continuing with this tonight. I have one question. While I was searching the internet for information about asc355, I found that bleepingcomputer.com characterizes asc3550 as a valid program (http://www.bleepingcomputer.com/startups/asc3550-12733.html). I assume that my version of asc3550 is somehow different than the friendly version and deleting it will not cause any problems. Is this correct? (I don't have any SCSI devices connected to my computer anyway.)


This one is valid. This one isn't.

Notice the difference in the last character...O(Oh) vs 0(Zero). If you do a google search using the driver name asc355O that shows in your log, you will find just three hits, which indicates to me that this is a relatively new piece of malware that obviously requires some more study.

The worst case scenario is from This Thread...I have been trying to help you avoid reformatting and reinstalling but of course, it's your option.

...I'd like to add to the quote above from our PM's, ALSO for the benefit of the casual forum reader, this is a perfect example as to why it is so important to copy and paste when instructed, rather than trying to type when researching these issues. Not that you did anything wrong. In fact, you did everything right...however, there are those here who may be victims of this issue themselves, and from having read through this, may indeed be saving themselves from serious heartburn by having cited this example.

This attempt to run AVG Anti-Spyware went better than last time, though still not perfect. I installed, changed the settings as instructed, and updated. In particular, I selected "Automatically generate report after every scan" and I unchecked "Only if threats were found" and I selected "Quarantine" under "How to act?". I ran a scan in Safe Mode. The scan found 146 threats: 144 tracking cookies, 2 Adware objects, 1 Not.A.Virus Hoax. After the scan completed, I selected Apply All Actions. But the Save Report button remained grayed-out. So I didn't know what else to do except move on to KillBox.

I followed all the KillBox instructions, but after pressing the red X and confirming, I received the following message: "PendingFileRenameOperations Registry Data has been Removed by External Process!" And I was NOT prompted to reboot. I tried following the instructions again, changing the last character in the filename to a 0 (zero) instead of an O (oh) but I got the same message.

A new HijackThis log is appended below.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:58:52 PM, on 9/20/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1188195863193
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1188195832018
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe (file missing)

--
End of file - 5478 bytes

When you ran the killbox and rebooted, did killbox tell you the file did not exist?

If all went well, no need to run gmer again, it's log is incredibly long. A combofix scan will show us the same information that we now know was present in the gmer log and was also a legitimately BAD piece of malware.

Let's see a fresh combofix scan log now.

Message Edited by 1972vet on 09-20-2007 11:37 PM

I forgot to mention that the computer still seems to be running well. I haven't noticed any issues.

I ran through the KillBox instructions again and manually rebooted. You asked me to "Post the results". What should I post? Does KillBox generate a log? A current HijackThis log is appended. Do I need to run a gmer scan now?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:22:09 AM, on 9/21/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1188195863193
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1188195832018
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe (file missing)

--
End of file - 5534 bytes

KillBox didn't tell me the file didn't exist. The only message I received was the one I described in my previous post.

I tried running ComboFix again. First I was told that my copy of ComboFix had expired, so I deleted my copy and downloaded a new copy. Then, after pressing 1 to continue, but before beginning the scan, I got a message saying ComboFix had found a rootkit infection and needed to reboot. After reboot, the scan continued, followed by another reboot, as usual. I also received several alerts from ZoneAlarm during the scan saying that NirCmd.exe and NirCmd.cfexe were trying to access the internet or the trusted zone. I allowed all of these.

The ComboFix log and a new HijackThis log are appended.

ComboFix log:

ComboFix 07-09-20.1 - "Annie Fowler" 2007-09-21 0:58:10.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.50 [GMT -4:00]
* Created a new restore point
.
Rootkit driver pe386 is present. ... attempting disinfection
Rootkit driver msguard is present. ... attempting disinfection
Rootkit driver lzx32 is present. ... attempting disinfection
Rootkit driver huy32 is present. ... attempting disinfection
Rootkit driver xpdt is present. ... attempting disinfection
Rootkit driver pe386 is still present. A rootkit scan is required
Rootkit driver msguard is still present. A rootkit scan is required
Rootkit driver lzx32 is still present. A rootkit scan is required
Rootkit driver huy32 is still present. A rootkit scan is required
Rootkit driver xpdt is still present. A rootkit scan is required

((((((((((((((((((((((((( Files Created from 2007-08-21 to 2007-09-21 )))))))))))))))))))))))))))))))
.

2007-09-20 21:38 d-------- C:\!KillBox
2007-09-20 19:35 10,872 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2007-09-13 01:47 2,856 --a------ C:\WINDOWS\SYSTEM32\tmp.reg
2007-09-09 16:11 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
2007-09-09 16:10 75,248 --a------ C:\WINDOWS\zllsputility.exe
2007-09-09 16:10 4,212 ---h----- C:\WINDOWS\SYSTEM32\zllictbl.dat
2007-09-09 16:10 11,264 --a------ C:\WINDOWS\SYSTEM32\SpOrder.dll
2007-09-09 16:08 d-------- C:\WINDOWS\Internet Logs
2007-09-08 14:27 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-08 08:36 d-------- C:\VundoFix Backups
2007-09-02 22:19 d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Real
2007-09-02 22:04 86,016 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\pctspk.exe
2007-09-02 22:04 86,016 --a------ C:\WINDOWS\SYSTEM32\pctspk.exe
2007-09-02 21:54 d-------- C:\DOCUME~1\Annie\APPLIC~1\Real
2007-09-02 21:35 41,600 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\weitekp9.dll
2007-09-02 21:35 31,232 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\weitekp9.sys
2007-09-02 21:22 489,984 --a------ C:\WINDOWS\SYSTEM32\hypertrm.dll
2007-09-02 21:22 200,704 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\wordpad.exe
2007-09-02 21:22 189,440 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\wuaueng.dll
2007-09-02 21:22 189,440 --a------ C:\WINDOWS\SYSTEM32\wuaueng.dll
2007-09-02 21:22 139,776 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\wuauclt.exe
2007-09-02 21:22 139,776 --a------ C:\WINDOWS\SYSTEM32\wuauclt.exe
2007-09-02 21:11 24,661 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\spxcoins.dll
2007-09-02 21:11 24,661 --a------ C:\WINDOWS\SYSTEM32\spxcoins.dll
2007-09-02 21:11 13,312 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\irclass.dll
2007-09-02 21:11 13,312 --a------ C:\WINDOWS\SYSTEM32\irclass.dll
2007-09-02 19:19 593,408 --a------ C:\WINDOWS\SYSTEM32\xpsp2res.dll
2007-09-02 19:16 6,550 --a------ C:\WINDOWS\jautoexp.dat
2007-09-02 19:15 113 --a------ C:\WINDOWS\SYSTEM32\zonedon.reg
2007-09-02 19:15 113 --a------ C:\WINDOWS\SYSTEM32\zonedoff.reg
2007-09-02 17:11 d-------- C:\DOCUME~1\ANNIEF~1\APPLIC~1\Roxio
2007-09-01 13:09 76,016 --a------ C:\Program Files\setup.exe
2007-09-01 10:11 d-------- C:\Program Files\Trend Micro
2007-08-31 22:31 d-------- C:\Program Files\Spybot
2007-08-31 22:31 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-08-31 21:50 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-08-31 21:41 d-------- C:\Program Files\Common Files\Wise Installation Wizard

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-08-31 21:50 --------- d-------- C:\Program Files\Lavasoft
2007-08-31 21:45 --------- d-------- C:\DOCUME~1\ANNIEF~1\APPLIC~1\Lavasoft
2007-08-31 20:23 --------- d-------- C:\Program Files\McAfee
2007-08-22 08:10 --------- d-------- C:\Program Files\Opera
2007-08-16 22:39 --------- d-------- C:\Program Files\iTunes
2007-08-16 22:38 --------- d-------- C:\Program Files\iPod
2007-08-16 22:35 --------- d-------- C:\Program Files\QuickTime
2007-08-16 22:24 --------- d-------- C:\Program Files\Apple Software Update
2007-08-16 22:24 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-08-12 16:28 --------- d-------- C:\Program Files\Microsoft AntiSpyware
2007-08-12 16:23 --------- d-------- C:\Program Files\AVPersonal
2007-08-12 16:18 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
2007-08-12 16:17 --------- d-------- C:\Program Files\Common Files\Cisco Systems
2007-08-12 16:15 --------- d-------- C:\Program Files\Common Files\McAfee
2007-08-12 16:07 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee.com
2007-08-12 15:56 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
2007-08-07 13:58 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-07 13:56 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"@"="" []
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2003-09-25 19:53]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2006-11-30 08:50]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 13:39]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-31 18:44]
"AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 15:53]
"PCTVOICE"="pctspk.exe" [2001-08-17 22:36 C:\WINDOWS\SYSTEM32\pctspk.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2003-05-02 18:21]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2003-05-02 18:15]
"ATIModeChange"="Ati2mdxx.exe" [2002-08-28 18:17 C:\WINDOWS\SYSTEM32\Ati2mdxx.exe]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" []

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"tscuninstall"=%systemroot%\system32\tscupgrd.exe

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2007-09-02 21:28:16]

C:\DOCUME~1\ADMINI~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2007-09-02 21:28:16]

C:\DOCUME~1\ANNIEF~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]

C:\DOCUME~1\Annie\STARTM~1\Programs\Startup\
DESKTOP.INI [2007-09-02 21:28:16]

C:\DOCUME~1\DEFAUL~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2007-09-02 21:28:16]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 8.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 8.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL Companion.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL Companion.lnk
backup=C:\WINDOWS\pss\AOL Companion.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
"C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange]
Ati2mdxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
C:\Program Files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry]
C:\WINDOWS\System32\DSentry.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E6TaskPanel]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
C:\Program Files\McAfee.com\Agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
"C:\Program Files\Microsoft Money\System\mnyexpr.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE]
pctspk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WLTRYSVC"=2 (0x2)
"WANMiniportService"=2 (0x2)
"MCVSRte"=2 (0x2)
"McShield"=3 (0x3)
"iPodService"=3 (0x3)
"Ati HotKey Poller"=2 (0x2)

.
Contents of the 'Scheduled Tasks' folder
"2007-08-17 02:25:13 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-21 01:05:48
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-21 1:08:24 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-21 01:08
.
--- E O F ---