Hi,
I tried to run it last night, it was taking hours so I left it to run overnight. This morning, internet connection was lost and there was nothing showing on the screen.
I have run it again tonight and it produced this log:
ComboFix 10-02-01.01 - Administrator 01/02/2010 19:10:40.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.502.297 [GMT 0:00]
Running from: c:\documents and settings\Administrator.NPD2-LAP\Desktop\commy.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Anti-Virus *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\real.txt
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_MYWEBSEARCHSERVICE
((((((((((((((((((((((((( Files Created from 2010-01-01 to 2010-02-01 )))))))))))))))))))))))))))))))
.
2010-01-31 15:59 . 2010-01-31 15:59 -------- d-----w- C:\_OTL
2010-01-27 21:07 . 2010-01-27 21:07 -------- d-----w- c:\program files\ESET
2010-01-27 20:29 . 2010-01-27 20:29 696832 ----a-w- c:\windows\is-IVE9V.exe
2010-01-27 20:28 . 2010-01-27 20:28 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-13 21:44 . 2009-11-21 15:51 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-01 19:23 . 2008-04-03 12:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-02-01 19:22 . 2008-04-03 12:25 1166624 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-02-01 19:21 . 2008-04-03 12:25 110420 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-02-01 19:21 . 2008-04-03 12:26 553520 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-02-01 19:21 . 2008-04-03 12:26 41321760 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-01 16:18 . 2009-10-30 07:29 69 ----a-w- c:\documents and settings\Administrator.NPD2-LAP\jagex_runescape_preferences.dat
2010-01-28 21:32 . 2009-08-25 21:31 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-28 20:43 . 2009-10-30 07:30 69 ----a-w- c:\documents and settings\Administrator.NPD2-LAP\jagex_runescape_preferences2.dat
2010-01-27 20:58 . 2009-09-17 15:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-07 16:07 . 2009-09-17 15:18 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 16:07 . 2009-09-17 15:18 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 10:00 . 2004-08-04 12:00 832512 ----a-w- c:\windows\system32\wininet.dll
2010-01-05 10:00 . 2004-08-04 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00 . 2004-08-04 12:00 17408 ------w- c:\windows\system32\corpol.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus D68 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE" [2005-01-25 98304]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus D68 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE" [2005-01-25 98304]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-06-27 413696]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-481770310-1815239787-619646970-1074\Scripts\Logon\0\0]
"Script"=\\decorpart.co.uk\SysVol\decorpart.co.uk\scripts\time script.bat
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15000:UDP"= 15000:UDP:Kaspersky Administration Kit
R2 klnagent;Kaspersky Network Agent;c:\program files\Kaspersky Lab\NetworkAgent\klnagent.exe [14/11/2007 18:18 95120]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/05/2007 16:49 24344]
S1 mailKmd;mailKmd; [x]
S3 flash;flash;c:\windows\system32\drivers\flash.sys [06/02/2008 13:48 7040]
S3 POWERKEY;POWERKEY;c:\program files\Launch Manager\POWERKEY.SYS [06/02/2008 14:24 2343]
.
Contents of the 'Scheduled Tasks' folder
2010-01-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-507921405-725345543-500Core.job
- c:\documents and settings\Administrator.NPD2-LAP\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-22 19:27]
2010-02-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-507921405-725345543-500UA.job
- c:\documents and settings\Administrator.NPD2-LAP\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-22 19:27]
.
.
------- Supplementary Scan -------
.
uStart Page =
hxxp://www.google.co.uk/uDefault_Search_URL =
hxxp://www.google.com/ieuInternet Connection Wizard,ShellNext =
hxxp://www.viruslist.com/en/search?VN=Hidden%20object&referer=wksuSearchAssistant =
hxxp://www.google.com/ieuSearchURL,(Default) =
hxxp://www.google.com/search?q=%sIE: &Search
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: {2665693B-C4F3-434B-83DB-7574CF50C8B7} -
hxxp://www.kaspersky.co.uk/downloads/misc/kasperskylicensefinder.cab.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2010-02-01 19:23
Windows 5.1.2600 Service Pack 3 NTFS
scanning hȋdden processes ...
scanning hȋdden autostart entries ...
scanning hȋdden files ...
scan completed successfully
hȋdden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(968)
c:\windows\system32\klogon.dll
- - - - - - - > 'explorer.exe'(3568)
c:\windows\system32\WININET.dll
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\scrchpg.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\wltrysvc.exe
c:\windows\System32\bcmwltry.exe
c:\windows\system32\acs.exe
c:\acer\eManager\anbmServ.exe
.
**************************************************************************
.
Completion time: 2010-02-01 19:34:28 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-01 19:34
Pre-Run: 42,588,856,320 bytes free
Post-Run: 44,976,754,688 bytes free
- - End Of File - - A00EC1E55764E6FC64F2903256EBC82F