Hello.
Here's the combofix log :
ComboFix 09-12-26.05 - Sam 12/28/2009 0:55.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.502.269 [GMT 5.5:30]
Running from: c:\documents and settings\Sam\Desktop\Combo-Fix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected
Restored copy from - Kitty ate it :p
.
((((((((((((((((((((((((( Files Created from 2009-11-27 to 2009-12-27 )))))))))))))))))))))))))))))))
.
2009-12-27 16:43 . 2009-12-27 16:43 -------- d-----w- c:\documents and settings\Sam\Application Data\gnupg
2009-12-26 09:03 . 2009-12-27 16:42 -------- d-----w- c:\program files\uTorrent
2009-12-26 09:03 . 2009-12-27 19:01 -------- d-----w- c:\documents and settings\Sam\Application Data\uTorrent
2009-12-26 03:59 . 2009-12-26 03:59 -------- d-----w- C:\_OTM
2009-12-24 20:47 . 2009-12-24 20:47 152576 ----a-w- c:\documents and settings\Sam\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-24 20:44 . 2009-12-24 20:47 79488 ----a-w- c:\documents and settings\Sam\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-24 19:30 . 2009-12-24 19:30 -------- d-----w- c:\documents and settings\Sam\Application Data\Malwarebytes
2009-12-24 19:30 . 2009-12-03 10:44 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-24 19:30 . 2009-12-24 19:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-24 19:30 . 2009-12-24 19:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-24 19:30 . 2009-12-03 10:43 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-24 18:49 . 2009-12-24 18:49 -------- d-----w- c:\program files\TrendMicro
2009-12-21 18:27 . 2004-08-03 17:38 25600 -c--a-w- c:\windows\system32\dllcache\usbser.sys
2009-12-21 18:27 . 2004-08-03 17:38 25600 ----a-w- c:\windows\system32\drivers\usbser.sys
2009-12-21 18:27 . 2008-03-21 08:27 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll
2009-12-21 18:06 . 2009-12-21 18:07 -------- d-----w- c:\documents and settings\Sam\Application Data\Nokia
2009-12-21 18:06 . 2009-12-21 18:07 -------- d-----w- c:\documents and settings\Sam\Application Data\PC Suite
2009-12-21 18:06 . 2009-12-21 18:06 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite
2009-12-21 18:05 . 2009-12-21 18:05 -------- d-----w- c:\program files\Common Files\PCSuite
2009-12-21 18:04 . 2009-09-27 17:41 33773208 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Nokia_PC_Suite_7_1_30_9_eng_web.exe
2009-12-21 18:04 . 2009-12-21 18:04 95232 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\pcswpcsi.exe
2009-12-21 18:04 . 2009-12-21 18:04 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstCCD.exe
2009-12-21 18:04 . 2009-12-21 18:04 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-12-21 18:04 . 2009-12-21 18:04 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCS.exe
2009-12-21 18:03 . 2009-12-21 18:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations
2009-12-21 15:46 . 2009-12-21 15:46 -------- d-----w- c:\windows\Sun
2009-12-17 07:08 . 2009-12-17 07:08 -------- d-----w- c:\documents and settings\Sam\fontconfig
2009-12-17 07:05 . 2009-12-27 11:12 -------- d-----w- c:\program files\MPlayer for Windows
2009-12-14 09:04 . 2009-12-15 09:08 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-14 09:04 . 2009-03-30 04:03 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-12-14 09:04 . 2009-02-13 05:59 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-12-14 09:04 . 2009-02-13 05:47 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-12-14 09:04 . 2009-12-14 09:04 -------- d-----w- c:\program files\Avira
2009-12-14 09:04 . 2009-12-14 09:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-12-03 03:01 . 2009-12-03 03:02 -------- d-----w- c:\documents and settings\Sam\Local Settings\Application Data\Ahead
2009-12-03 02:59 . 2009-12-05 09:46 -------- d-----w- c:\documents and settings\Sam\Application Data\Ahead
2009-12-03 02:59 . 2009-12-03 02:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Ahead
2009-12-03 02:56 . 2009-12-03 02:58 -------- d-----w- c:\program files\Common Files\Ahead
2009-12-03 02:56 . 2009-12-03 02:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-12-03 02:56 . 2009-12-03 02:56 -------- d-----w- c:\program files\Nero
2009-12-02 17:51 . 2009-12-02 18:03 -------- d-----w- c:\documents and settings\Sam\Application Data\dvdcss
2009-11-30 21:37 . 2009-11-30 21:37 -------- d-----w- c:\windows\system32\KB905474
2009-11-30 21:37 . 2009-03-10 16:56 1403264 ----a-w- c:\windows\system32\KB905474\wganotifypackageinner.exe
2009-11-30 21:37 . 2009-03-10 16:48 453512 ----a-w- c:\windows\system32\KB905474\wgasetup.exe
2009-11-30 21:34 . 2004-08-03 19:26 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-11-30 21:32 . 2009-11-30 21:32 -------- d-----w- c:\windows\ServicePackFiles
2009-11-30 00:07 . 2009-11-30 01:32 -------- d-----w- c:\windows\system32\CatRoot_bak
2009-11-29 23:08 . 2009-08-04 13:58 2136064 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-11-29 23:08 . 2009-08-04 14:00 2180352 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-11-29 23:08 . 2009-08-04 13:13 2015744 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-11-29 23:08 . 2009-08-04 13:13 2057728 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-11-29 22:41 . 2008-10-24 11:10 453632 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-11-29 21:30 . 2008-07-09 07:38 26488 ----a-w- c:\windows\system32\spupdsvc.exe
2009-11-29 21:30 . 2009-11-30 21:38 -------- d--h--w- c:\windows\$hf_mig$
2009-11-29 19:16 . 2008-06-13 13:10 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-11-29 19:16 . 2008-06-13 13:10 272128 ------w- c:\windows\system32\drivers\bthport.sys
2009-11-29 18:45 . 2009-10-10 22:47 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-29 18:26 . 2009-11-29 18:32 -------- d-----w- c:\windows\SxsCaPendDel
2009-11-28 13:07 . 2001-08-17 08:18 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys
2009-11-28 13:07 . 2001-08-17 08:18 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2009-11-28 13:07 . 2001-08-17 08:32 9600 -c--a-w- c:\windows\system32\dllcache\hidusb.sys
2009-11-28 13:07 . 2001-08-17 08:32 9600 ----a-w- c:\windows\system32\drivers\hidusb.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-21 18:27 . 2009-12-21 18:27 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-12-21 18:27 . 2009-12-21 18:27 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-12-21 18:06 . 2009-12-21 18:05 -------- d-----w- c:\program files\DIFX
2009-12-21 18:05 . 2009-12-21 18:05 -------- d-----w- c:\program files\Common Files\Nokia
2009-12-21 18:05 . 2009-12-21 18:04 -------- d-----w- c:\program files\Nokia
2009-12-21 18:05 . 2009-12-21 18:05 -------- d-----w- c:\program files\PC Connectivity Solution
2009-12-21 02:09 . 2009-11-26 20:58 -------- d-----w- c:\program files\Common Files\Adobe
2009-11-30 16:00 . 2009-11-27 12:24 -------- d-----w- c:\documents and settings\Sam\Application Data\vlc
2009-11-29 18:33 . 2009-11-26 20:38 68456 ----a-w- c:\documents and settings\Sam\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-27 18:26 . 2009-11-27 18:26 -------- d-----w- c:\program files\Google
2009-11-27 11:52 . 2009-11-27 11:52 0 ----a-w- c:\windows\nsreg.dat
2009-11-26 21:15 . 2009-11-26 21:15 -------- d-----w- c:\program files\VideoLAN
2009-11-26 21:14 . 2009-11-26 21:14 -------- d-----w- c:\documents and settings\Sam\Application Data\Media Player Classic
2009-11-26 21:02 . 2009-11-26 21:02 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-11-26 20:55 . 2009-11-26 20:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-11-26 20:54 . 2009-11-26 20:54 -------- d-----w- c:\program files\Microsoft Works
2009-11-26 20:53 . 2009-11-26 20:53 -------- d-----w- c:\program files\MSBuild
2009-11-26 20:35 . 2009-11-26 20:35 -------- d-----w- c:\program files\Intel
2009-11-26 20:35 . 2009-11-26 20:35 -------- d-----w- c:\program files\Synaptics
2009-11-26 20:35 . 2009-11-26 20:35 -------- d-----w- c:\program files\Common Files\InstallShield
2009-11-26 20:30 . 2009-11-26 20:30 -------- d-----w- c:\program files\GCC4243N_fw
2009-11-26 20:24 . 2009-11-26 20:24 -------- d-----w- c:\program files\WIDCOMM
2009-11-26 18:54 . 2009-11-26 18:27 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-11-26 18:28 . 2009-11-26 18:28 -------- d-----w- c:\program files\microsoft frontpage
2009-11-26 18:24 . 2009-11-26 18:24 21640 ----a-w- c:\windows\system32\emptyregdb.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-07-19 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-07-19 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-07-19 114688]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 688218]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"MPlayerForWindows_UpdateReminder"="c:\program files\MPlayer for Windows\AutoUpdate.exe" [2009-12-06 254329]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-02 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2004-6-2 565309]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"d:\\Games\\CS\\COUNTER STRIKE\\COUNTER STRIKE\\Condition Zero\\czero.exe"=
"d:\\Games\\AOE\\age2_x1.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [12/14/2009 2:34 PM 108289]
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-12-28 01:01
Windows 5.1.2600 Service Pack 2 NTFS
scanning hȋdden processes ...
scanning hȋdden autostart entries ...
scanning hȋdden files ...
scan completed successfully
hȋdden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(764)
c:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\windows\system32\wscntfy.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclBCBTSrv.exe
c:\\?\c:\windows\system32\WBEM\WMIADAP.EXE
.
**************************************************************************
.
Completion time: 2009-12-28 01:03:14 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-27 19:33
Pre-Run: 898,711,552 bytes free
Post-Run: 871,034,880 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - F868D7911C66B80040031608D4EA7BD7