Thanks for you ongoing help.
I re-ran Combo-fix. Here's the resulting log. Please advise if any further action needed to ensure my computer is 'clean'. Thanks.
ComboFix 09-07-07.A9 - Rick Allred 07/08/2009 10:22.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.767.458 [GMT -7:00]
Running from: c:\documents and settings\Rick Allred\Desktop\Combo-Fix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\windows\010112010146118114.dat
c:\windows\freddy49.exe
c:\windows\Installer\e94aec9.msp
c:\windows\Installer\e94aed8.msp
c:\windows\Installer\e94aee7.msp
c:\windows\Installer\e94aef6.msp
c:\windows\ld11.exe
c:\windows\ld12.exe
c:\windows\strt_1246567643.exe
c:\windows\strt_1246579860.exe
c:\windows\sysguard.exe
c:\windows\system32\drivers\UACrvmlkafkabenxfcmu.sys
c:\windows\system32\UACdboljijfjobcqrsek.dll
c:\windows\system32\UACdinethnyxbcpthewr.log
c:\windows\system32\UACfedgrklvegmkajcvj.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UAClynapjpxejepualso.dat
c:\windows\system32\UACpaeulvebutpvaoykx.dll
c:\windows\system32\UACxtfndpcoybirxjgwo.dll
c:\windows\system32\wbem\proquota.exe
c:\windows\system32\proquota.exe was missing
Restored copy from - c:\windows\ServicePackFiles\i386\proquota.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_UACd.sys
-------\Legacy_DRV
-------\Legacy_WKSPATCH
-------\Service_drv
((((((((((((((((((((((((( Files Created from 2009-06-08 to 2009-07-08 )))))))))))))))))))))))))))))))
.
2009-07-04 02:42 . 2008-04-14 00:12 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe
2009-07-04 02:42 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe
2009-07-03 06:44 . 2009-06-17 18:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-03 06:44 . 2009-06-17 18:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-02 23:17 . 2009-07-02 23:17 -------- d-----w- c:\program files\Trend Micro
2009-07-02 21:12 . 2009-07-03 06:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-01 16:14 . 2009-07-04 02:44 -------- d-----w- c:\program files\drv
2009-06-24 05:04 . 2009-06-24 05:04 -------- d-----w- c:\documents and settings\Rick Allred\Application Data\Malwarebytes
2009-06-24 05:04 . 2009-06-24 05:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-23 19:44 . 2009-06-24 05:57 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-22 02:45 . 2009-06-24 06:01 -------- d-----w- c:\program files\VideoLAN
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-24 20:32 . 2007-12-24 06:20 -------- d-----w- c:\documents and settings\Rick Allred\Application Data\U3
2009-06-24 20:22 . 2009-06-24 20:22 0 ----a-w- C:\LOGE1.tmp
2009-06-23 18:54 . 2006-10-11 01:17 -------- d-----w- c:\program files\McAfee
2009-06-05 04:52 . 2009-03-08 15:19 -------- d-----w- c:\program files\StarSonata
2009-05-25 16:51 . 2009-05-23 15:34 -------- d-----w- c:\program files\Sony Online Entertainment
2009-05-24 02:21 . 2009-05-24 02:21 0 ----a-w- C:\LOG8FE.tmp
2009-05-18 22:08 . 2009-05-18 22:08 0 ----a-w- c:\windows\nsreg.dat
2009-05-17 17:21 . 2009-05-17 17:21 0 ----a-w- C:\LOG195.tmp
2009-05-17 14:50 . 2009-05-17 14:50 0 ----a-w- C:\LOG154.tmp
2009-05-07 15:32 . 2002-09-03 16:39 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:56 . 2004-02-07 01:05 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 07:56 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-28 02:19 . 2008-02-02 06:04 34062 ----a-w- c:\documents and settings\Rick Allred\Application Data\Move Networks\ie_bin\Uninst.exe
2009-04-28 02:19 . 2009-04-28 02:19 1047072 ----a-w- c:\documents and settings\Rick Allred\Application Data\Move Networks\MoveMediaPlayer_071303000006.exe
2009-04-17 12:26 . 2002-09-03 17:11 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-05-05 15:36 585216 ----a-w- c:\windows\system32\rpcrt4.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-07 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-03-14 4493312]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"cwcptray"="c:\program files\ContentWatch\Internet Protection\cwtray.exe" [2007-05-30 396592]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-06-13 180269]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-07-31 1836544]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-09 645328]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"BCMSMMSG"="BCMSMMSG.exe" - c:\windows\BCMSMMSG.exe [2003-08-29 122880]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
APC UPS Status.lnk - c:\program files\APC\APC PowerChute Personal Edition\Display.exe [2004-5-3 209016]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
officejet 6100.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe [2003-4-6 147456]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\CwWLEvent]
2006-02-21 16:50 868352 ----a-w- c:\program files\ContentWatch\Internet Protection\common\cwplc001.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=c:\windows\pss\HotSync Manager.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8085:TCP"= 8085:TCP:drv
R1 drvdrv;drvdrv;c:\program files\drv\drv.sys [7/1/2009 9:14 AM 9344]
R2 CwAltaService20;ContentWatch;c:\program files\ContentWatch\Internet Protection\cwsvc.exe [12/1/2007 7:05 AM 1217840]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 smp_lpt;smp_lpt;c:\windows\system32\drivers\smp_LPT.sys [12/30/2008 9:48 PM 37928]
--- Other Services/Drivers In Memory ---
*Deregistered* - dump_wmimmc
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
drv REG_MULTI_SZ drv
.
Contents of the 'Scheduled Tasks' folder
2009-06-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]
2009-06-15 c:\windows\Tasks\McDefragTask.job
- c:\windows\system32\defrag.exe [2002-09-03 00:12]
2009-07-01 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2006-10-11 18:53]
.
- - - - ORPHANS REMOVED - - - -
Notify-WgaLogon - (no file)
.
------- Supplementary Scan -------
.
uStart Page =
hxxp://www.lds.org/uSearchMigratedDefaultURL =
hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) =
hxxp://www.google.com/search?q=%sIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
LSP: c:\windows\system32\cwalsp.dll
TCP: {4EAB100A-3509-4CE9-9179-A2FC9F6CC06C} = 68.94.156.1,68.94.157.1
DPF: DirectAnimation Java Classes -
file://c:\windows\Java\classes\dajava.cabDPF: Microsoft XML Parser for Java -
file://c:\windows\Java\classes\xmldso.cabFF - ProfilePath - c:\documents and settings\Rick Allred\Application Data\Mozilla\Firefox\Profiles\53v7rhhp.default\
FF - plugin: c:\progra~1\SONYON~1\npsoe.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-07-08 10:34
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1757981266-813497703-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{E5F952F5-FF1F-E43C-4BD3-0249710167B2}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"oajibnhepeipoggaokgdihcdblmlfa"=hex:62,61,68,6b,00,b1
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'lsass.exe'(748)
c:\windows\system32\cwalsp.dll
c:\windows\system32\wxbase28u_vc_CW.dll
.
Completion time: 2009-07-08 10:38
ComboFix-quarantined-files.txt 2009-07-08 17:37
Pre-Run: 10,931,187,712 bytes free
Post-Run: 11,445,796,864 bytes free
191 --- E O F --- 2009-07-02 18:57